VulnerabilityModified
CVE-2025-23184
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6.
HIGH 7.5EPSS 2.13%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.13% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- apache/cxf
- Source
- security@apache.org
References
- https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122Mailing List
- http://www.openwall.com/lists/oss-security/2025/01/20/3Mailing List
- https://security.netapp.com/advisory/ntap-20250214-0003/
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.