CVE-2019-12406: Medium severity Apache CXF vulnerability
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Other sources
Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachments present in a given message. By sending a specially-crafted message containing an overly large number of message attachments, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-12406?
CVE-2019-12406 is a vulnerability in Apache CXF that allows a malicious user to perform a denial of service attack by sending a message with a large number of attachments.
What is the severity of CVE-2019-12406?
The severity of CVE-2019-12406 is medium with a CVSS score of 6.5.
How does CVE-2019-12406 affect Apache CXF?
CVE-2019-12406 affects Apache CXF versions before 3.3.4 and 3.2.11, allowing a denial of service attack by exploiting the unrestricted number of message attachments.
How can I fix CVE-2019-12406?
To fix CVE-2019-12406, upgrade to Apache CXF version 3.3.4 or 3.2.11.
Where can I find more information about CVE-2019-12406?
More information about CVE-2019-12406 can be found at the following references: [link 1], [link 2], [link 3].