CVE-2024-41172

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

CVSS 5.3 MEDIUMEPSS 1.2%CWE-401

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 1.2%KEV nãoPoC —Patch referenciado

Lifecycle

19 Jul 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Apache Software Foundation · Apache CXF

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6 https://security.netapp.com/advisory/ntap-20240808-0008/http://www.openwall.com/lists/oss-security/2024/07/18/4