CVE-2025-23184CWE-400

Apache CXF: Denial of Service vulnerability with temporary files

Medium · published January 21, 2025

CVSS v3.1
5.9
EPSS
2%
Percentile
81.8
In the wild
Unconfirmed
What it is

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02134 · 81.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2025-01-21T09:35Z
EPSS history
Timeline
  • 21 JAN 09:35Z
    Apache CXF: Denial of Service vulnerability with temporary files
    cvelistv5