What’s Vulnerable › Vulnerabilities
CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 7.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-06-16 · updated 2026-06-17
- Weakness: CWE-400
Description
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Affected products
- Apache Software Foundation Apache CXF: before 3.3.11; from 3.4.0 before 3.4.4 — fixed in 3.3.11, 3.4.4
- Apache TomEE: 8.0.6
- Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
- Oracle Communications Element Manager: 8.2.2
- Oracle Communications Messaging Server: 8.1
How to fix
Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.3.11, 3.4.4. Check the vendor advisory for mitigations.
References
- http://cxf.apache.org/security-advisories.data/CVE-2021-30468.txt.asc
- http://www.openwall.com/lists/oss-security/2021/06/16/2
- https://lists.apache.org/thread.html/r3f46ae38e4a6e80c069cdb320e0ce831b0a21a12ef0cc92c0943f34a%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r4771084730c4cf6e59eda60b4407122c86f174eb750b24f610ba9ff4%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459%40%3Cusers.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r54c0f1cbbb9f381dfbedb9ea5e90ecb1c0a15371f40c4b10322ac737%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/ra833f78b3fa577cb43558cf343859a1bf70b1c5ce2353b3877d96422%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/rac07822057521dccf33ab5d136e0e8c599a6e2c8ac75e44ffbdc6e07%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/re5b2a2b77faa22684d47bd2ac6623135c615565328ff40a1ec705448%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/re9e05c6cab5f0dcc827eba4e6fcf26fa0b493e7ca84d62c867a80d03%40%3Ccommits.tomee.apache.org%3E
Get alerted when CVE-2021-30468 or the next vulnerability affects your stack