VULNERABILITY INTELLIGENCE
CVE-2025-23184
CVSS score5.9 MEDIUM
EPSS probability2.19%
CISA KEVNot currently listed
Published2025-01-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).
Weakness classification
- security@apache.org: CWE-400
- nvd@nist.gov: NVD-CWE-noinfo