What’s Vulnerable › Vulnerabilities

CVE-2025-23184: Apache CXF: Denial of Service vulnerability with temporary files

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-21 · updated 2026-06-17
• Weakness: CWE-400

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Affected products

• Apache Software Foundation Apache CXF: before 3.5.10; from 3.6.0 before 3.6.5; from 4.0.0 before 4.0.6 — fixed in 3.5.10, 3.6.5, 4.0.6

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache CXF 3.5.10, 3.6.5, 4.0.6. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/lfs8l63rnctnj2skfrxyys7v8fgnt122
• http://www.openwall.com/lists/oss-security/2025/01/20/3
• https://security.netapp.com/advisory/ntap-20250214-0003/
• https://www.vicarius.io/vsociety/posts/cve-2025-23184-detect-apache-cxf-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-23184-mitigate-apache-cxf-vulnerability

Get alerted when CVE-2025-23184 or the next vulnerability affects your stack