Login Request a demo
Medium severity · published Nov 14, 2017
CVE-2017-12624
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications
5.5
CVSS
3.7%
EPSS
No
On KEV
Description
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cxf · Apache
3.0.0 before 3.0.16; 3.1.0 before 3.1.14; 3.2.0 before 3.2.1 · source: NVD
Affected product
CX
Cxf
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12624
Issue Tracking
http://cxf.apache.org/security-advisories.data/CVE-2017-12624.txt.asc
Third Party Advisory
http://www.securityfocus.com/bid/101859
Third Party Advisory
http://www.securitytracker.com/id/1040486
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2423
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2424
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:2425
More from Cxf
9.8
CVE-2026-68079
Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
9.8
CVE-2026-66909
Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
9.8
CVE-2026-50628
Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-44930
Apache CXF: LDAP Injection vulnerability in XKMS LDAP Repository