GHSA-fh5r-crhr-qrrq
Apache CXF: Denial of Service vulnerability with temporary files
At a glance
- Published
- Updated
- CVE
- CVE-2025-23184
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.cxf:cxf-core | introduced 0, fixed 3.5.10 |
| Maven · org.apache.cxf:cxf-core | introduced 3.6.0, fixed 3.6.5 |
| Maven · org.apache.cxf:cxf-core | introduced 4.0.0, fixed 4.0.6 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-23184 ADVISORY
- https://github.com/apache/cxf/pull/2048 WEB
- https://github.com/apache/cxf/pull/2111 WEB
- https://github.com/apache/cxf PACKAGE
- https://issues.apache.org/jira/browse/CXF-7396 WEB
- https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122 WEB
- https://security.netapp.com/advisory/ntap-20250214-0003 WEB
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability WEB
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability WEB
- http://www.openwall.com/lists/oss-security/2025/01/20/3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |