CVE-2025-23184

HIGH7.5EPSS 0.15%

Apache CXF: Denial of Service vulnerability with temporary files

Published: 1/21/2025Modified: 2/4/2026

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Affected packages (1)

Maven/org.apache.cxf:cxf-corefrom 0, < 3.5.10

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-23184
PATCHhttps://github.com/apache/cxf
WEBhttps://github.com/apache/cxf/pull/2048
WEBhttps://github.com/apache/cxf/pull/2111
WEBhttps://issues.apache.org/jira/browse/CXF-7396
WEBhttps://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122
WEBhttps://security.netapp.com/advisory/ntap-20250214-0003
WEBhttps://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability
WEBhttps://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability
WEBhttp://www.openwall.com/lists/oss-security/2025/01/20/3