CVE-2024-32007— Apache CXF Denial of Service vulnerability in JOSE
Quick assessment
Affected
Apache Software Foundation Apache CXF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache CXF是美国阿帕奇（Apache）基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。 Apache CXF存在安全漏洞，该漏洞源于输入验证不正确，允许攻击者执行拒绝服务攻击。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-32007
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache CXF Denial of Service vulnerability in JOSE
Source: CVE Program / CVE List V5
Vulnerability Description
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache CXF 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache CXF是美国阿帕奇（Apache）基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。 Apache CXF存在安全漏洞，该漏洞源于输入验证不正确，允许攻击者执行拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache CXF | 0 ~ 4.0.5, 3.6.4, 3.5.9 | - |
|
II. Public POCs for CVE-2024-32007
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-32007
请登录查看更多情报信息。
Mailing List Discussions for CVE-2024-32007 (1)
-
https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2024-07-19 · 4 CVEs total
| CVE-2024-41107 | Apache CloudStack: SAML Signature Exclusion | |
| CVE-2024-41172 | Apache CXF: Unrestricted memory consumption in CXF HTTP clients | |
| CVE-2024-29736 | Apache CXF: SSRF vulnerability via WADL stylesheet parameter |
IV. Related Vulnerabilities
Same product: Apache CXF
-
CVE-2026-108039
Apache CXF: Prevent unbounded XML document size in StaxUtils -
CVE-2026-107938
Apache CXF: The Netty HTTP client transport does not perform -
CVE-2026-107937
Apache CXF: The attachment header size and count limits can -
CVE-2026-100227
Apache CXF: XML Signature wrapping in JAX-RS XML Security -
CVE-2026-97791
Apache CXF: STSTokenValidator can accept untrusted SAML asse
Same vendor: Apache Software Foundation
-
CVE-2026-113582
Apache Abdera: XML external entity expansion in Atom documen -
CVE-2026-103634
Apache DataSketches: datasketches-cpp: Out-of-bounds read an -
CVE-2026-112381
Apache Traffic Server: Nullptr dereference in net_write_io o -
CVE-2026-111817
Apache Traffic Server: Dropping chunked trailers stalls a pa -
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-contr
Same weakness: CWE-400
-
CVE-2026-115778
Twisted: Unauthenticated Remote Denial of Service in the Twi -
CVE-2026-115776
Twisted: Unauthenticated Remote Denial of Service in the Twi -
CVE-2026-115775
Twisted: Unauthenticated Remote Denial of Service in the Twi -
CVE-2026-115774
Twisted: Denial of Service in the Twisted IMAP4 Server via a -
CVE-2026-115585
pypdf: Possible long runtimes for repeated malformed cross-r
V. Comments for CVE-2024-32007
No comments yet