CVE-2014-3584
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
- EPSS
- 7.2% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-399
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:cxf
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gw5j-77f9-v2g2 | Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >=2.5.0 <2.6.11 | 2.6.11 |
| GHSA-gw5j-77f9-v2g2 | Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >=2.7.0 <2.7.8 | 2.7.8 |
| GHSA-gw5j-77f9-v2g2 | Maven | org.apache.cxf:cxf-rt-frontend-jaxrs | >=3.0.0 <3.0.1 | 3.0.1 |