Loading vulnerability…
Memory-Exhaustion Denial of Service in Apache CXF SOAP Endpoints
CVE-2014-0109 is an uncontrolled memory-consumption vulnerability in Apache CXF versions before 2.6.14 in the 2.6 branch and before 2.7.11 in the 2.7 branch. When a large POST request with a Content-Type of text/html is submitted to a SOAP endpoint, CXF generates an error message from attacker-controlled input. Processing this input can consume excessive memory and trigger an out-of-memory condition.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can exhaust memory in an application using a vulnerable Apache CXF SOAP endpoint, potentially triggering an out-of-memory error and denying service to the application.
If you can’t patch tonight, do this now.
Until patched, restrict access to SOAP endpoints to trusted clients where feasible and enforce HTTP request-body size limits at the reverse proxy, web server, application server, or API gateway. Reject unsupported Content-Type values, including text/html, before requests reach CXF SOAP processing.
Patch, then assume compromise.
Upgrade Apache CXF cxf-core to version 2.6.14 or later in the 2.6 branch, or version 2.7.11 or later in the 2.7 branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.