Resource exhaustion in Apache Cxf
CVE-2025-23184
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Vulnerability class: DoS (Denial of Service)
EPSS: 0.020 (78.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Cxf
- Apache Software Foundation Cxf — versions 0, 3.6.0, 4.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-23184?
- CVE-2025-23184 is a medium-severity vulnerability in Apache Cxf, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2025-01-21.
- How severe is CVE-2025-23184?
- Medium severity. CVSS v3 base score is 5.9 out of 10.