Description
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | < 4.0.5, 3.6.4, 3.5.9 | 4.0.5, 3.6.4, 3.5.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf-rt-rs-security-jose | >= 4.0.0, < 4.0.5 | 4.0.5 | GHSA-6pff-fmh2-4mmf |
| Maven | org.apache.cxf:cxf-rt-rs-security-jose | >= 3.6.0, < 3.6.4 | 3.6.4 | GHSA-6pff-fmh2-4mmf |
| Maven | org.apache.cxf:cxf-rt-rs-security-jose | < 3.5.9 | 3.5.9 | GHSA-6pff-fmh2-4mmf |
Advisories 5
- WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2024-1678 Apache CXF: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 19, 2026
- NCSC-2025-0129 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Apr 16, 2025
- NCSC-2024-0416 Kwetsbaarheden verholpen in Oracle Financial Services Applications NCSC-NL (Netherlands) · Oct 17, 2024
- WID-SEC-2024-3192 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 15, 2024
References
- https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633 vendor-advisory