CVE-2025-23184

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jan 21, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-231854.1Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in CVE-2025-231868.5In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request CVE-2025-231875.3Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate techni CVE-2025-231884.3An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access CVE-2025-231894.3Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technica CVE-2025-23198.8The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.11.13 to 5.CVE-2025-231904.3Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data t CVE-2025-231913.1Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP G CVE-2025-231927.6SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a wor CVE-2025-231937.5SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based CVE-2025-231945.3SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-au CVE-2025-231957.5An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This