Read the docs
TI-2014-02908 Aliases CVE-2014-3584GHSA-gw5j-77f9-v2g2

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before…

Priority LOW 33CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

Why it matters now

EPSS 0.07177 94th percentileScored 2026-11-07
Fix Partial org.apache.cxf:cxf-rt-frontend-jaxrs (Maven): 2.6.11, 2.7.8, 3.0.1Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.cxf:cxf-rt-frontend-jaxrs (Maven)2.5.0 to before 2.6.112.6.11Patch availableGHSA-gw5j-77f9-v2g2
—org.apache.cxf:cxf-rt-frontend-jaxrs (Maven)2.7.0 to before 2.7.82.7.8Patch availableGHSA-gw5j-77f9-v2g2
—org.apache.cxf:cxf-rt-frontend-jaxrs (Maven)3.0.0 to before 3.0.13.0.1Patch availableGHSA-gw5j-77f9-v2g2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) Vendor— Affected 2.5.0 to before 2.6.11 Fixed in 2.6.11 Patch available GHSA-gw5j-77f9-v2g2
  • org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) Vendor— Affected 2.7.0 to before 2.7.8 Fixed in 2.7.8 Patch available GHSA-gw5j-77f9-v2g2
  • org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-gw5j-77f9-v2g2

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*up to 2.6.10VulnerableApache
cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*2.6.1VulnerableApache
cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableApache
cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableApache
cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*2.7.2VulnerableApache
cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*2.7.3VulnerableApache
cpe:2.3:a:apache:cxf:2.7.4:*:*:*:*:*:*:*2.7.4VulnerableApache
cpe:2.3:a:apache:cxf:2.7.5:*:*:*:*:*:*:*2.7.5VulnerableApache
cpe:2.3:a:apache:cxf:2.7.6:*:*:*:*:*:*:*2.7.6VulnerableApache
cpe:2.3:a:apache:cxf:2.7.7:*:*:*:*:*:*:*2.7.7VulnerableApache
  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions up to 2.6.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.6:*:*:*:*:*:*:* Versions 2.7.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:cxf:2.7.7:*:*:*:*:*:*:* Versions 2.7.7 Vulnerable ·Apache
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableApache
  • cpe:2.3:a:apache:cxf:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-gw5j-77f9-v2g2 org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) Fixed in 2.6.11 Advisory →
  • Fix · GHSA-gw5j-77f9-v2g2 org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) Fixed in 2.7.8 Advisory →
  • Fix · GHSA-gw5j-77f9-v2g2 org.apache.cxf:cxf-rt-frontend-jaxrs (Maven) Fixed in 3.0.1 Advisory →

Red Hat 1 advisory

  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Enterprise 1AffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise 2AffectedNo fix yet
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400
Not affected: 8 products
  • Red Hat BPM Suite 6
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss SOA Platform 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3584
  2. 2026-10-03 Alias added: GHSA-gw5j-77f9-v2g2

References

Advisory 2

Other 17

  • TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
  • TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
  • TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
  • TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences