What’s Vulnerable › Vulnerabilities

CVE-2024-32007: Apache CXF Denial of Service vulnerability in JOSE

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-19 · updated 2026-06-17
• Weakness: CWE-20

Description

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

Affected products

• Apache Software Foundation Apache CXF: before 3.5.9; from 3.6.0 before 3.6.4; from 4.0.0 before 4.0.5 — fixed in 3.5.9, 3.6.4, 4.0.5

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.5.9, 3.6.4, 4.0.5. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633
• http://www.openwall.com/lists/oss-security/2024/07/18/3
• https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633
• https://security.netapp.com/advisory/ntap-20240808-0009/

Get alerted when CVE-2024-32007 or the next vulnerability affects your stack