CVE-2024-32007CWE-20CWE-400

Apache CXF Denial of Service vulnerability in JOSE

High · published July 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
69.8
In the wild
Unconfirmed
What it is

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01280 · 69.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-400 · Uncontrolled Resource Consumption
Published
2024-07-19T08:50Z
EPSS history
Timeline
  • 19 JUL 08:50Z
    Apache CXF Denial of Service vulnerability in JOSE
    cvelistv5