CVE-2017-12624

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
Apache Software FoundationApache CXFprior to 3.1.14; 3.2.x prior to 3.2.1

References

Timeline

Published
Nov 14, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-126254.3Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be definedCVE-2017-126267.5Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, CVE-2017-126279.8In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer dereference under certain CVE-2017-126287.8The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be uCVE-2017-126299.8Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config ACVE-2017-126305.4In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effeCVE-2017-126318.8Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request ForCVE-2017-126327.5A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host heaCVE-2017-126339.8The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulneraCVE-2017-126349.8The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerabCVE-2017-126359.8Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x bCVE-2017-126367.2CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating sy
CVE-2017-12624: Medium severity, CVSS 5.5 | Vulnix