CVE-2021-30468: apache software foundation apache cxf Uncontrolled Resource Consumption
Vulnerability summary
CVE-2021-30468 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in apache software foundation apache cxf. EPSS estimates a 7.02% chance of exploitation in the next 30 days, higher than 94.1% of scored vulnerabilities.
Timeline
- 16-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
7.02%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 7.02% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected systems
Oracle3 products
- business_intelligence5.5.0.0.0 | 5.9.0.0.0 | 12.2.1.3.0 | 12.2.1.4.0
- communications_element_manager8.2.2
- communications_messaging_server8.1
Org.apache.cxf2 products
- apache-cxf≥ 3.4.0, < 3.4.4 | < 3.3.11
- cxf≥ 3.4.0, < 3.4.4 | < 3.3.11
Apache software foundation1 product
- apache cxf≥ Apache CXF, < 3.4.4
4 vendors · 8 products
References
27 links- www.openwall.com/lists/oss-security/2021/06/16/2Mailing ListX Refsource MLISTWEBThird Party Advisory
