PkgSeer

Vulnerability GHSA-36wv-v2qp-v4g4

Medium Risk
MEDIUM RISK
CVSS Score: 5.6
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
July 15, 2025 at 03:31 PM UTC
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged
4.1.0
4.1.0

Summary

Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Details

Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk
3 months ago
Apache cxf-core: No restriction on attachment headers per message
4.2.0 - 4.2.1 GHSA-ghvc-7hp8-2g2v
4.2.0 - 4.2.1 GHSA-ghvc-7hp8-2g2v
Critical
3 months ago
Apache CXF has Improper Restriction of XML External Entity Reference
4.2.0 - 4.2.1 GHSA-xw5h-cmh3-8j6j
4.2.0 - 4.2.1 GHSA-xw5h-cmh3-8j6j
High Risk
1 year ago
Apache CXF: Denial of Service vulnerability with temporary files
>=3.0.0 <3.0.17, >=3.1.0 <3.1.19, >=3.2.0 <3.2.15, >=3.3.0 <3.3.14, >=3.4.0 <3.4.11, >=3.5.0 <3.5.10, >=3.6.0 <3.6.5, >=4.0.0 <4.0.6 GHSA-fh5r-crhr-qrrq
>=3.0.0 <3.0.17, >=3.1.0 <3.1.19, >=3.2.0 <3.2.15, >=3.3.0 <3.3.14, >=3.4.0 <3.4.11, >=3.5.0 <3.5.10, >=3.6.0 <3.6.5, >=4.0.0 <4.0.6 GHSA-fh5r-crhr-qrrq
Critical
3 years ago
Apache CXF Server-Side Request Forgery vulnerability
>=3.0.0 <3.0.17, >=3.1.0 <3.1.19, >=3.2.0 <3.2.15, >=3.3.0 <3.3.14, >=3.4.0 <3.4.10, >=3.5.0 <3.5.5 GHSA-x3x3-qwjq-8gj4
>=3.0.0 <3.0.17, >=3.1.0 <3.1.19, >=3.2.0 <3.2.15, >=3.3.0 <3.3.14, >=3.4.0 <3.4.10, >=3.5.0 <3.5.5 GHSA-x3x3-qwjq-8gj4
High Risk
3 years ago
Apache CXF vulnerable to Exposure of Sensitive Information
>=3.0.0 <3.0.17, >=3.1.0 <3.1.19, >=3.2.0 <3.2.15, >=3.3.0 <3.3.14, >=3.4.0 <3.4.10, >=3.5.0 <3.5.5 GHSA-3w37-5p3p-jv92
>=3.0.0 <3.0.17, >=3.1.0 <3.1.19, >=3.2.0 <3.2.15, >=3.3.0 <3.3.14, >=3.4.0 <3.4.10, >=3.5.0 <3.5.5 GHSA-3w37-5p3p-jv92
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
1 year ago
July 15, 2025 at 03:31 PM UTC
Fixed (3.5.11)
Unknown
Unknown
Fixed (3.6.6)
Unknown
Unknown
Fixed (4.0.7)
Unknown
Unknown
Fixed (4.1.1)
Unknown
Unknown
Last Modified
23 days ago
September 10, 2026 at 03:50 AM UTC