NetSight
IP …
high7.5

CVE-2021-30468

Infinite loop in Apache CFX

Impact

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.cxf:apache-cxf>= 3.4.0, < 3.4.43.4.4
mavenorg.apache.cxf:cxf>= 3.4.0, < 3.4.43.4.4

Affected products

VendorProductAffected versions
ApacheCxf
before 3.3.11
from 3.4.0 before 3.4.4
ApacheTomee
Version 8.0.6
OracleBusiness Intelligence
Versions 5.5.0.0.0, 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Element Manager
Version 8.2.2
OracleCommunications Messaging Server
Version 8.1

Weakness classification

CWE-400CWE-835

References