CVE-2025-23184

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Score

CVSS 3.1 7.5 High

Status

Modified - security@apache.org

Published

2025-01-21

Last modified

2025-12-15

Weaknesses

CWE-400

Affected products

• Cxf (Apache)
• Apache Cxf (Apache Software Foundation)

References

• https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122
• http://www.openwall.com/lists/oss-security/2025/01/20/3
• https://security.netapp.com/advisory/ntap-20250214-0003/
• https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability