CVE-2021-30468

HIGH

Apache CXF <3.4.4-3.3.11 - DoS

Title source: llm
STIX 2.1

Description

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

References (15)

Core 15
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/06/16/2
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210917-0002/
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html

Scores

CVSS v3 7.5
EPSS 0.0190
EPSS Percentile 83.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400 CWE-835
Status published
Products (10)
apache/cxf < 3.3.11
apache/tomee 8.0.6
oracle/business_intelligence 5.5.0.0.0
oracle/business_intelligence 5.9.0.0.0
oracle/business_intelligence 12.2.1.3.0
oracle/business_intelligence 12.2.1.4.0
oracle/communications_element_manager 8.2.2
oracle/communications_messaging_server 8.1
org.apache.cxf/apache-cxf 3.4.0 - 3.4.4Maven
org.apache.cxf/cxf 3.4.0 - 3.4.4Maven
Published Jun 16, 2021
Tracked Since Feb 18, 2026