CVE-2013-2160
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
- EPSS
- 32% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWE
- CWE-399
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-254q-rp36-v2m8 | Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >=2.5.0 <2.5.10 | 2.5.10 |
| GHSA-254q-rp36-v2m8 | Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >=2.6.0 <2.6.7 | 2.6.7 |
| GHSA-254q-rp36-v2m8 | Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >=2.7.0 <2.7.4 | 2.7.4 |