CVE-2024-41172

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Database specific

{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.6.0, 4.0.0"
                },
                {
                    "fixed": "3.6.4, 4.0.5"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "3.6.4"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-401"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41172.json"
}

References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type

GIT

Repo

https://github.com/apache/cxf

Events

Introduced

4cf375c5436f3e806293a73a5bb6a8510f7ac961

Fixed

6b27aec74e5329b60e84ff2478c854bf2acf3db5

Introduced

02310e95fe74c0c031f540f3284e4a9bd856ced2

Fixed

630d7368e073d379227d48ff4797c23377dc5ebf

Database specific

{
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.4"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.5"
        }
    ]
}

Affected versions

cxf-3.*

cxf-3.6.0

cxf-3.6.1

cxf-3.6.2

cxf-3.6.3

cxf-4.*

cxf-4.0.0

cxf-4.0.1

cxf-4.0.2

cxf-4.0.3

cxf-4.0.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41172.json"