Loading vulnerability…
Apache CXF Invalid SOAP Message Temporary Storage Exhaustion
CVE-2014-0110 is an uncontrolled resource-consumption vulnerability in Apache CXF versions before 2.6.14 in the 2.6.x branch and before 2.7.11 in the 2.7.x branch. When SOAP-message parsing or processing encounters a fault before the message has been fully consumed, CXF can write the remaining attacker-controlled content to a temporary file. A remote attacker can submit a large malformed SOAP message to cause excessive temporary disk consumption.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can exhaust temporary or underlying filesystem disk capacity, causing denial of service for the affected Apache CXF application and potentially other services sharing that storage.
If you can’t patch tonight, do this now.
Until patched, restrict SOAP endpoint access to trusted clients, enforce request-size limits before CXF processes requests, apply rate limiting, and isolate or monitor temporary storage so abnormal consumption is detected and cannot exhaust shared system capacity.
Patch, then assume compromise.
Upgrade Apache CXF to version 2.6.14 or later on the 2.6.x branch, or to version 2.7.11 or later on the 2.7.x branch. Apply the corresponding vendor updates for products that bundle Apache CXF, then restart affected application-server processes where required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.