CVE-2024-41172

Published: Jul 19, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Affected (2)

Products: Apache: Cxf

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	From 3.6.0 to 3.6.4
Apache Cxf	From 4.0.0 to 4.0.5

Related CWEs

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (4)

https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2024/07/18/4

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

https://security.netapp.com/advisory/ntap-20240808-0008/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.