CVE-2024-32007

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32007
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32007.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32007
Aliases
Published
2024-07-19T08:50:31.832Z
Modified
2026-07-15T01:49:13.418002044Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache CXF Denial of Service vulnerability in JOSE
Details

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. 

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20",
        "CWE-400"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "4.0.5, 3.6.4, 3.5.9"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "4.0.5"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32007.json"
}
References

Affected packages

Git / github.com/apache/cxf

Affected ranges

Type
GIT
Repo
https://github.com/apache/cxf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8c68c138ce0b7f5c1945e744f7cf5067a8298374
Introduced
4cf375c5436f3e806293a73a5bb6a8510f7ac961
Fixed
6b27aec74e5329b60e84ff2478c854bf2acf3db5
Introduced
02310e95fe74c0c031f540f3284e4a9bd856ced2
Fixed
630d7368e073d379227d48ff4797c23377dc5ebf
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.5.9"
        },
        {
            "introduced": "3.6.0"
        },
        {
            "fixed": "3.6.4"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.5"
        }
    ]
}

Affected versions

cxf-2.*
cxf-2.1
cxf-2.1.2
cxf-2.2
cxf-2.2.1
cxf-2.2.2
cxf-2.3.0
cxf-2.4.0
cxf-2.5.0
cxf-2.5.1
cxf-2.6.0
cxf-2.6.1
cxf-2.7.0
cxf-2.7.1
cxf-2.7.2
cxf-3.*
cxf-3.0.0
cxf-3.0.0-milestone2
cxf-3.1.0
cxf-3.1.1
cxf-3.1.2
cxf-3.1.3
cxf-3.1.4
cxf-3.2.0
cxf-3.2.1
cxf-3.2.2
cxf-3.2.3
cxf-3.2.4
cxf-3.2.5
cxf-3.3.0
cxf-3.3.1
cxf-3.3.2
cxf-3.3.3
cxf-3.4.0
cxf-3.4.1
cxf-3.5.0
cxf-3.5.1
cxf-3.5.2
cxf-3.5.3
cxf-3.5.4
cxf-3.5.5
cxf-3.5.6
cxf-3.5.7
cxf-3.5.8
cxf-3.6.0
cxf-3.6.1
cxf-3.6.2
cxf-3.6.3
cxf-4.*
cxf-4.0.0
cxf-4.0.1
cxf-4.0.2
cxf-4.0.3
cxf-4.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32007.json"