CVE-2025-23184 — Apache CXF: Denial of Service vulnerability with temporary files

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache CXF	< 3.5.10, 3.6.0 – < 3.6.5, 4.0.0 – < 4.0.6	3.5.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-apache-cxf +3	3.1.16-7.redhat_00007.1.ep7.el7	RHSA-2026:33372, RHSA-2026:33371
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-21.SP19_redhat_00001.1.ep7.el7	RHSA-2026:33372, RHSA-2026:33371
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +4	7.3.18-3.GA_redhat_00001.1.el7eap	RHSA-2026:33371
Red Hat JBoss EAP 8	eap8-activemq-artemis +14	2.33.0-3.redhat_00017.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-apache-commons-beanutils	1.11.0-1.redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-apache-cxf +3	4.0.6-2.redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-apache-mime4j +2	0.8.12-1.redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-eap-product-conf-parent +1	800.8.0-1.GA_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-elytron-web	4.0.3-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-fastinfoset	2.1.1-1.redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-hal-console	3.6.24-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-hibernate +2	6.2.36-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-httpcomponents-asyncclient	4.1.5-4.redhat_00006.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-jboss-remoting	5.0.31-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-jbossws-cxf	7.3.3-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-narayana +8	6.0.6-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-neethi	3.2.1-1.redhat_00002.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-reactivex-rxjava2	2.2.21-3.redhat_00002.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-slf4j +1	2.0.17-1.redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-velocity +1	2.3.0-4.redhat_00010.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-wildfly +4	8.0.8-4.GA_redhat_00006.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 8	eap8-wildfly-elytron +1	2.2.11-1.Final_redhat_00001.1.el8eap	RHSA-2025:10453, RHSA-2025:10452
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.16.0-21.redhat_00055.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-apache-cxf +3	3.5.10-1.redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-artemis-native +1	1:1.0.2-5.redhat_00004.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-elytron-web +1	1.9.6-1.Final_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-glassfish-jsf	2.3.14-9.SP10_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-hal-console	3.3.27-1.Final_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-hibernate-validator +1	6.0.23-3.SP2_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-ironjacamar +8	1.5.21-1.Final_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-jboss-server-migration +2	1.10.0-42.Final_redhat_00042.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-jbossws-cxf	5.4.15-1.Final_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-wildfly +4	7.4.23-3.GA_redhat_00002.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-wildfly-elytron +1	1.15.26-1.Final_redhat_00001.1.el7eap	RHSA-2025:10926, RHSA-2025:10925, RHSA-2025:10924
Red Hat JBoss EAP 7	eap7-wildfly-java-jdk17	7.4.23-3.GA_redhat_00002.1.el8eap	RHSA-2025:10926, RHSA-2025:10925

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.cxf:cxf-core	< 3.5.10	3.5.10	GHSA-fh5r-crhr-qrrq
Maven	org.apache.cxf:cxf-core	>= 3.6.0, < 3.6.5	3.6.5	GHSA-fh5r-crhr-qrrq
Maven	org.apache.cxf:cxf-core	>= 4.0.0, < 4.0.6	4.0.6	GHSA-fh5r-crhr-qrrq

Advisories 19

RHSA-2026:33371 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:33372 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.15 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
RHSA-2025:10926 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2025:10925 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2025:10924 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.23 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2025:10453 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2025:10452 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.8 Security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
WID-SEC-2026-0783 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
WID-SEC-2026-0351 Dell NetWorker (Third Party Components): Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
WID-SEC-2025-0823 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
WID-SEC-2025-0128 Apache CXF: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 29, 2026
ICSA-25-261-04 Multiple Open-Source Software Vulnerabilities in Hitachi Energy Asset Suite Product CISA ICS & IT advisories · Aug 26, 2025
WID-SEC-2025-1555 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
NCSC-2025-0128 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Apr 16, 2025
NCSC-2025-0127 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Apr 16, 2025
NCSC-2025-0124 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Apr 16, 2025
WID-SEC-2025-0822 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
WID-SEC-2025-0819 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
WID-SEC-2025-0818 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025

References

https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122 vendor-advisory

CNA	v3.1	5.9
EUVD	v3.1	5.9
OSV:GHSA	v3.1	7.5