GHSA-36wv-v2qp-v4g4

Source

https://github.com/advisories/GHSA-36wv-v2qp-v4g4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-36wv-v2qp-v4g4/GHSA-36wv-v2qp-v4g4.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-36wv-v2qp-v4g4

Aliases

CVE-2025-48795

Related

Published

2025-07-15T15:31:00Z

Modified

2025-07-17T17:16:43.152525Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Details

Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.

Database specific

{
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2025-07-16T14:27:18Z",
    "cwe_ids": [
        "CWE-400"
    ],
    "nvd_published_at": "2025-07-15T15:15:24Z"
}

References

Affected packages

Maven / org.apache.cxf:cxf-core

Package

Name: org.apache.cxf:cxf-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.5.11

Affected versions

3.*

3.0.0-milestone1

3.0.0-milestone2

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.0.10

3.0.11

3.0.12

3.0.13

3.0.14

3.0.15

3.0.16

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.1.10

3.1.11

3.1.12

3.1.13

3.1.14

3.1.15

3.1.16

3.1.17

3.1.18

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2.10

3.2.11

3.2.12

3.2.13

3.2.14

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

3.3.6

3.3.7

3.3.8

3.3.9

3.3.10

3.3.11

3.3.12

3.3.13

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.4.7

3.4.8

3.4.9

3.4.10

3.5.0

3.5.1

3.5.2

3.5.3

3.5.4

3.5.5

3.5.6

3.5.7

3.5.8

3.5.9

3.5.10

Maven / org.apache.cxf:cxf-core

Package

Name: org.apache.cxf:cxf-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.6.0

Fixed

3.6.6

Affected versions

3.*

3.6.0

3.6.1

3.6.2

3.6.3

3.6.4

3.6.5

Maven / org.apache.cxf:cxf-core

Package

Name: org.apache.cxf:cxf-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.7

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

Maven / org.apache.cxf:cxf-core

Package

Name: org.apache.cxf:cxf-core; View open source insights on deps.dev
Purl: pkg:maven/org.apache.cxf/cxf-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Fixed

4.1.1

Affected versions

4.*

4.1.0