Description
Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.
Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache CXF | 3.5.10 – < 3.5.11, 3.6.5 – < 3.6.6, 4.0.6 – < 4.0.7, 4.1.0 – < 4.1.1 | 3.5.11 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-tika-3.1 +1 | 3.1.0-r7 | — |
| Wolfi rolling | apache-tika-3.2 +1 | 3.2.1-r3 | — |
| Wolfi rolling | wildfly +4 | 36.0.1-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cxf:cxf-core | < 3.5.11 | 3.5.11 | GHSA-36wv-v2qp-v4g4 |
| Maven | org.apache.cxf:cxf-core | >= 3.6.0, < 3.6.6 | 3.6.6 | GHSA-36wv-v2qp-v4g4 |
| Maven | org.apache.cxf:cxf-core | >= 4.0.0, < 4.0.7 | 4.0.7 | GHSA-36wv-v2qp-v4g4 |
| Maven | org.apache.cxf:cxf-core | >= 4.1.0, < 4.1.1 | 4.1.1 | GHSA-36wv-v2qp-v4g4 |
Advisories 11
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1193 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2025-1574 Apache CXF: Schwachstelle ermöglicht Denial of Service und Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 29, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0160 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2359 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 23, 2025
- NCSC-2025-0334 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Nov 21, 2025
- NCSC-2025-0335 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0329 Kwetsbaarheden verholpen in Oracle Commerce NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-2357 Oracle Commerce: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2025
References
- https://lists.apache.org/thread/vo5qv02mvv5plmb6z2xf1ktjmrpv3jmn vendor-advisory