CVE-2024-41172

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

CVSS 5.3 MEDIUMEPSS 1.2%CWE-401

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.3EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

19 jul 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Produtos afetados

Apache Software Foundation · Apache CXF

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6 https://security.netapp.com/advisory/ntap-20240808-0008/http://www.openwall.com/lists/oss-security/2024/07/18/4