The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a de

Summary

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Timeline

1. Jul 9, 2013Public exploit on Exploit-DB

   EDB-26710

2. Aug 19, 2013, 11:00 PM UTCCVE published
3. Aug 6, 2024, 3:27 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• org.apache.cxf:cxf-rt-frontend-jaxrsMaven

  From 2.5.0 · fixed in 2.5.10

• org.apache.cxf:cxf-rt-frontend-jaxrsMaven

  From 2.6.0 · fixed in 2.6.7

• org.apache.cxf:cxf-rt-frontend-jaxrsMaven

  From 2.7.0 · fixed in 2.7.4

References 13