CVE-2024-41172

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run  out of memory
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
apacheCNA
---
---
CISA-ADPADP
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
VendorProductVersion
apachecxf
3.6.4 <
𝑥
< 3.6.4
apachecxf
4.0.5 <
𝑥
< 4.0.5
apachecxf
3.6.0 ≤
𝑥
< 3.6.4
apachecxf
4.0.0 ≤
𝑥
< 4.0.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6
http://www.openwall.com/lists/oss-security/2024/07/18/4
https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6
https://security.netapp.com/advisory/ntap-20240808-0008/