Description
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache CXF | Apache CXF versions before 3.3.4 and 3.2.11 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:apache-cxf | < 3.2.11 | 3.2.11 | GHSA-58p8-9g59-q2hr |
| Maven | org.apache.cxf:apache-cxf | >= 3.3.0, < 3.3.4 | 3.3.4 | GHSA-58p8-9g59-q2hr |
| Maven | org.apache.cxf:cxf | < 3.2.11 | 3.2.11 | GHSA-58p8-9g59-q2hr |
| Maven | org.apache.cxf:cxf | >= 3.3.0, < 3.3.4 | 3.3.4 | GHSA-58p8-9g59-q2hr |
Advisories 2
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1825 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 4, 2024
References
- [cxf-commits] 20200116 svn commit: r1055336 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-12423.txt.asc security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200319 svn commit: r1058035 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2019-17573.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20200401 svn commit: r1058573 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2020-1954.txt.asc security-advisories.html mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- [cxf-issues] 20200820 [jira] [Commented] (CXF-8328) CVE-2019-12406 not fixed in 3.1 branch mailing-list
- [cxf-issues] 20200820 [jira] [Created] (CXF-8328) CVE-2019-12406 not fixed in 3.1 branch mailing-list
- [cxf-issues] 20200821 [jira] [Commented] (CXF-8328) CVE-2019-12406 not fixed in 3.1 branch mailing-list
- [cxf-issues] 20200821 [jira] [Comment Edited] (CXF-8328) CVE-2019-12406 not fixed in 3.1 branch mailing-list
- [cxf-commits] 20201112 svn commit: r1067927 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2020-13954.txt.asc security-advisories.html mailing-list
- [cxf-commits] 20210402 svn commit: r1073270 - in /websites/production/cxf/content: cache/main.pageCache security-advisories.data/CVE-2021-22696.txt.asc security-advisories.html mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc
- [cxf-commits] 20210616 svn commit: r1075801 - in /websites/production/cxf/content: cache/main.pageCache index.html security-advisories.data/CVE-2021-30468.txt.asc security-advisories.html mailing-list