CVE-2025-23184

CWE-400 — Uncontrolled Resource Consumption7 documents6 sources
Severity
7.5HIGH
EPSS
0.1%
top 70.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache CXFApache CXF
Timeline
PublishedJan 21
Latest updateJul 15

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/cxf3.6.0 — 3.6.5+2
▶Mavenorg.apache.cxf:cxf-core3.6.0 — 3.6.5+2
▶CVEListV5apache_software_foundation/apache_cxf3.6.0 — 3.6.5+2

🔴Vulnerability Details

3
OSV
Apache CXF: Denial of Service vulnerability with temporary files↗2025-01-21
▶
CVEList
Apache CXF: Denial of Service vulnerability with temporary files↗2025-01-21
▶
GHSA
Apache CXF: Denial of Service vulnerability with temporary files↗2025-01-21
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Maintenance (Apache CXF) — CVE-2025-23184↗2025-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (Apache CXF) — CVE-2025-23184↗2025-04-15
▶
Red Hat
org.apache.cxf: Apache CXF: Denial of Service vulnerability with temporary files↗2025-01-21
▶
CVE-2025-23184 (HIGH CVSS 7.5) | A potential denial of service vulne | cvebase.io