CVE-2025-23184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-23184
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23184.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-23184
Aliases
Downstream
Related
Published
2025-01-21T09:35:37.468Z
Modified
2026-05-18T05:58:05.130462599Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache CXF: Denial of Service vulnerability with temporary files
Details

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23184.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.5.10"
                },
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "3.6.5"
                },
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
61dd77d25fc4e2ea9edef3c89a8d85c6719b863e
Introduced
4cf375c5436f3e806293a73a5bb6a8510f7ac961
Fixed
c33f8892bde3a502fc71ea1b31309f1ba78cfd7e
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
9967b754b2489f1812d2dd7792e8082a09f39ecf
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.5.10"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.5"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.6"
        }
    ],
    "source": "CPE_FIELD",
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*"
}

Affected versions

cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.5.1
cxf-3.5.2
cxf-3.5.3
cxf-3.5.4
cxf-3.5.5
cxf-3.5.6
cxf-3.5.7
cxf-3.5.8
cxf-3.5.9
cxf-3.6.0
cxf-3.6.1
cxf-3.6.2
cxf-3.6.3
cxf-3.6.4
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4
cxf-4.0.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-23184.json"