Description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache CXF
Default version status: unaffected
0 to < 3.5.10affected3.6.0 to < 3.6.5affected4.0.0 to < 4.0.6affected
References
- https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122 ↗
- http://www.openwall.com/lists/oss-security/2025/01/20/3 ↗
- https://security.netapp.com/advisory/ntap-20250214-0003/ ↗
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability ↗
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability ↗