View all vulnerabilities

CVE-2025-23184

Apache CXF: Denial of Service vulnerability with temporary files

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
org.apache.cxf:cxf-core < 3.5.10; org.apache.cxf:cxf-core >= 3.6.0 < 3.6.5; org.apache.cxf:cxf-core >= 4.0.0 < 4.0.6
Severity
High
Ecosystem
Publish Date
January 21, 2025
Modified Date
February 18, 2025