CVE-2025-23184

Published: Jan 21, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Affected (3)

Products: Apache: Cxf

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Apache Cxf	Before 3.5.10
Apache Cxf	From 3.6.0 to 3.6.5
Apache Cxf	From 4.0.0 to 4.0.6

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (5)

https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122

Source: security@apache.org

Mailing List

http://www.openwall.com/lists/oss-security/2025/01/20/3

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

https://security.netapp.com/advisory/ntap-20250214-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.