cve.bz

CVE-2021-30468

7.5 highEPSS 7.0%

High (7.5). EPSS 7.0% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:apache-cxf 3.3.11, 3.4.4.

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
7.0% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWEs
CWE-835, CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g23v-p5jq-jvh4Mavenorg.apache.cxf:apache-cxf>=3.4.0 <3.4.43.4.4
GHSA-g23v-p5jq-jvh4Mavenorg.apache.cxf:apache-cxf<3.3.113.3.11
GHSA-g23v-p5jq-jvh4Mavenorg.apache.cxf:cxf>=3.4.0 <3.4.43.4.4
GHSA-g23v-p5jq-jvh4Mavenorg.apache.cxf:cxf<3.3.113.3.11

References

Check your stackJSON