CVE-2024-41172
published 2024-07-19CVE-2024-41172: In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.20%
64.6th percentile
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | cxf | >= 3.6.0 < 3.6.4 | 3.6.4 |
| apache | cxf | >= 4.0.0 < 4.0.5 | 4.0.5 |
| apache_software_foundation | apache_cxf | >= 3.6.0, 4.0.0 < 3.6.4, 4.0.5 | 3.6.4, 4.0.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache CXF allows unrestricted memory consumption in CXF HTTP clients
osv·2024-07-19
CVE-2024-41172 [MEDIUM] Apache CXF allows unrestricted memory consumption in CXF HTTP clients
Apache CXF allows unrestricted memory consumption in CXF HTTP clients
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
GHSA
Apache CXF allows unrestricted memory consumption in CXF HTTP clients
ghsa·2024-07-19
CVE-2024-41172 [MEDIUM] CWE-401 Apache CXF allows unrestricted memory consumption in CXF HTTP clients
Apache CXF allows unrestricted memory consumption in CXF HTTP clients
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
Red Hat
apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients
vendor_redhat·2024-07-19·CVSS 7.5
CVE-2024-41172 [HIGH] CWE-401 apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients
apache: cxf: org.apache.cxf:cxf-rt-transports-http: unrestricted memory consumption in CXF HTTP clients
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
A memory consumption flaw was found in Apache CXF. This issue may allow a CXF HTTP client conduit to prevent HTTPClient instances from being garbage collected, eventually causing the application to run out of memory.
Package: org.apache.cxf/cxf-rt-transports-http (Red Hat build of Apache Camel for Spring Boot 3) - Not affected
Package: org.apache.cxf/cxf-rt-transports-http (Red Hat
No detection rules found.
No public exploits indexed.
2024-07-19
Published