Apache CXF allows unrestricted memory consumption in CXF HTTP clients
Low severity
GitHub Reviewed
Published
Jul 19, 2024
to the GitHub Advisory Database
•
Updated Aug 8, 2024
Package
Affected versions
>= 4.0.0, < 4.0.5
>= 3.6.0, < 3.6.4
Patched versions
4.0.5
3.6.4
Description
Published by the National Vulnerability Database
Jul 19, 2024
Published to the GitHub Advisory Database
Jul 19, 2024
Reviewed
Jul 19, 2024
Last updated
Aug 8, 2024
In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory
References