Resource exhaustion in Apache CXF - CVE-2025-23184

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU105112

Resource exhaustion in Apache CXF - CVE-2025-23184

Published: February 28, 2025


Vulnerability identifier: #VU105112
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-23184
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in CachedOutputStream instances allowing creation of enormous amount of temporary files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Apache CXF
Storage Protect for Virtual Environments: Data Protection for VMware
PowerVM NovaLink
Tivoli Network Manager IP Edition
Data Product Hub
Oracle BI Publisher
Storage Protect Backup-Archive Client
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Storage Protect for Space Management
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Rational Performance Tester
DevOps Test Performance
Oracle Banking Digital Experience
Business Automation Insights
Storage Protect Operations Center
Maximo Application Suite - IoT Component
IBM Virtualization Engine TS7700 3948-VED
System Storage Virtualization Engine TS7700 3948-VEF
Telco Service Activator
Guardium Data Protection
Log Analysis
IBM SPSS Analytic Server
IBM Spectrum Control
IBM Sterling B2B Integrator
IBM Tivoli Business Service Manager
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
Oracle WebCenter Forms Recognition
Primavera P6 Enterprise Project Portfolio Management
IBM Business Automation Workflow
IBM TXSeries for Multiplatforms
IBM Cloud Pak for Business Automation
IBM Sterling File Gateway
IBM Tivoli Application Dependency Discovery Manager
Oracle Banking Origination
JBoss Enterprise Application Platform
Oracle Communications Cloud Native Core Unified Data Repository
eap8-jboss-el (Red Hat package)
eap8-eventstream (Red Hat package)
eap8-bouncycastle (Red Hat package)
eap8-undertow (Red Hat package)
eap8-jboss-threads (Red Hat package)
eap8-wildfly-elytron (Red Hat package)
eap8-apache-cxf (Red Hat package)
eap8-wildfly-clustering (Red Hat package)
eap8-hibernate (Red Hat package)
eap8-wildfly-javadocs (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Virtualization Engine TS7700 3957-VED
IBM CICS TX Advanced
IBM CICS TX Standard
IBM InfoSphere Information Server

How to mitigate CVE-2025-23184

Install updates from vendor's website.

Apache CXF - addressed in versions 3.5.10, 3.6.5, 4.0.6
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.27.0
PowerVM NovaLink - addressed in versions 2.1.1-250528, 2.2.1.1-250529, 2.3.0.1-250610
Tivoli Network Manager IP Edition - update to 4.2.0.22
Data Product Hub - update to 5.2.0
IBM Spectrum Control - update to 5.4.13.2
IBM Sterling File Gateway - addressed in versions 6.1.2.7.1, 6.2.0.5, 6.2.1.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.7.1, 6.2.0.5, 6.2.1.1
IBM Tivoli Business Service Manager - update to 6.2.0.6
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Spectrum Symphony - update to 7.3.2 FP3
JBoss Enterprise Application Platform - update to 8.1.3
Storage Protect Backup-Archive Client - update to 8.1.27
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.27.0
Storage Protect for Space Management - update to 8.1.27.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.18
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.28, 8.7.22, 9.0.15, 9.1.1
IBM Maximo Application Suite - addressed in versions 8.10.29, 8.11.26, 9.0.15, 9.1.3
Maximo Application Suite - Monitor Component - addressed in versions 8.10.18, 8.11.16, 9.0.8
DevOps Test Performance - update to 11.0.8
IBM Business Automation Workflow - addressed in versions 24.0.0-IF006, 24.0.1-IF001
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
eap8-jboss-el (Red Hat package) - addressed in versions api_5.0_spec-4.0.2-1.Final_redhat_00001.1.el8eap, api_5.0_spec-4.0.2-1.Final_redhat_00001.1.el9eap
eap8-eventstream (Red Hat package) - addressed in versions 1.0.1-3.redhat_00003.1.el8eap, 1.0.1-3.redhat_00003.1.el9eap
eap8-bouncycastle (Red Hat package) - addressed in versions 1.82.0-1.redhat_00001.1.el8eap, 1.82.0-1.redhat_00001.1.el9eap
eap8-undertow (Red Hat package) - addressed in versions 2.3.20-2.SP4_redhat_00001.1.el8eap, 2.3.20-2.SP4_redhat_00001.1.el9eap
eap8-jboss-threads (Red Hat package) - addressed in versions 2.5.0-1.redhat_00001.1.el8eap, 2.5.0-1.redhat_00001.1.el9eap
eap8-wildfly-elytron (Red Hat package) - addressed in versions 2.6.6-1.Final_redhat_00001.1.el8eap, 2.6.6-1.Final_redhat_00001.1.el9eap
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.10-1.redhat_00001.1.el8eap, 4.0.10-1.redhat_00001.1.el9eap
eap8-wildfly-clustering (Red Hat package) - addressed in versions 5.0.12-1.Final_redhat_00001.1.el8eap, 5.0.12-1.Final_redhat_00001.1.el9eap
eap8-hibernate (Red Hat package) - addressed in versions 6.6.36-1.Final_redhat_00001.1.el8eap, 6.6.36-1.Final_redhat_00001.1.el9eap
eap8-wildfly-javadocs (Red Hat package) - addressed in versions 8.1.1-4.GA_redhat_00007.1.el8eap, 8.1.1-4.GA_redhat_00007.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.1.3-4.GA_redhat_00006.1.el8eap, 8.1.3-4.GA_redhat_00006.1.el9eap
Storage Protect Operations Center - update to 8.1.27
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.15, 9.0.6
Virtualization Engine TS7700 3957-VED - addressed in versions 8.54.1.27 VTD_EXEC.904, 8.54.2.17 VTD_EXEC.904, 8.60.0.115 VTD_EXEC.905
IBM Virtualization Engine TS7700 3948-VED - addressed in versions 8.54.1.27 VTD_EXEC.904, 8.54.2.17 VTD_EXEC.904, 8.60.0.115 VTD_EXEC.905
System Storage Virtualization Engine TS7700 3948-VEF - update to 8.60.0.115 VTD_EXEC.905
IBM TXSeries for Multiplatforms - addressed in versions 9.1.0.3, 10.1.0.0, 11.1.0.0 ifix6
IBM CICS TX Advanced - addressed in versions 10.1.0.0 ifix39, 11.1.0.0 ifix31
Telco Service Activator - update to 10.3.0
Guardium Data Protection - update to 11.0p494
IBM CICS TX Standard - update to 11.1.0.0 ifix32
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 6
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF004, 24.0.1-IF001
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 801.3.0-1.GA_redhat_00001.1.el8eap, 801.3.0-1.GA_redhat_00001.1.el9eap

External References

Related Security Bulletins