cve.bz

CVE-2024-32007

7.5 highEPSS 1.3%

High (7.5) in apache cxf. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in org.apache.cxf:cxf-rt-rs-security-jose 3.5.9, 3.6.4, 4.0.5.

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWEs
CWE-20, CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6pff-fmh2-4mmfMavenorg.apache.cxf:cxf-rt-rs-security-jose>=4.0.0 <4.0.54.0.5
GHSA-6pff-fmh2-4mmfMavenorg.apache.cxf:cxf-rt-rs-security-jose>=3.6.0 <3.6.43.6.4
GHSA-6pff-fmh2-4mmfMavenorg.apache.cxf:cxf-rt-rs-security-jose<3.5.93.5.9

References

Check your stackJSON