CVE-2016-5004

MEDIUM

Apache ws-xmlrpc 3.1.3 - Denial of Service via Content-Encoding Header Decompression

Title source: llm
STIX 2.1

Description

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

References (5)

Core 5
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/07/12/5
Third Party Advisory vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1036294
Exploit, Third Party Advisory x_refsource_misc
https://github.com/0ang3el/unsafe-xmlrpc
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91736

Scores

CVSS v3 6.5
EPSS 0.0106
EPSS Percentile 77.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (2)
apache/ws-xmlrpc 3.1.3
org.apache.xmlrpc/xmlrpc-common 0Maven
Published Jun 06, 2017
Tracked Since Feb 18, 2026