CVE-2025-23184

Published Jan 21, 2025

Last updated 8 days ago

CVSS medium 5.9

Overview

Description: A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Source: security@apache.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

security@apache.org: CWE-400
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4F551B7C-101F-4859-B2CD-C9F76D7C61F2",
            "versionEndExcluding": "3.5.10"
          },
          {
            "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A581BA3B-93A1-4AED-AAF7-041EFC91EFE7",
            "versionEndExcluding": "3.6.5",
            "versionStartIncluding": "3.6.0"
          },
          {
            "criteria": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3533A0DD-FA20-4427-A9A3-3FAFFF37D5BF",
            "versionEndExcluding": "4.0.6",
            "versionStartIncluding": "4.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References