HIGH 7.5 Maven
Apache CXF: Denial of Service vulnerability with temporary files
GHSA-fh5r-crhr-qrrq · CVE-2025-23184
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-23184
- WEB https://github.com/apache/cxf/pull/2048
- WEB https://github.com/apache/cxf/pull/2111
- PACKAGE https://github.com/apache/cxf
- WEB https://issues.apache.org/jira/browse/CXF-7396
- WEB https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122
- WEB https://security.netapp.com/advisory/ntap-20250214-0003
- WEB https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability
- WEB https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability
- WEB http://www.openwall.com/lists/oss-security/2025/01/20/3
Ready to move
Start Securing
Free, no credit card | First findings in minutes