Read the docs
TI-2021-05579 Aliases CVE-2021-22696GHSA-7q4h-pj78-j7vg

OAuth 2 authorization service vulnerable to DDos attacks

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.

Why it matters now

EPSS 0.06593 93rd percentileScored 2026-11-07
Fix Partial Apache CXF (Apache Software Foundation): 3.4.3, 3.3.10org.apache.cxf:cxf (Maven): 3.4.3, 3.3.10+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache CXFbefore 3.4.3; before 3.3.103.4.3, 3.3.10Patch availableCNA
—org.apache.cxf:cxf (Maven)3.4.0 to before 3.4.33.4.3Patch availableGHSA-7q4h-pj78-j7vg
—org.apache.cxf:cxf (Maven)before 3.3.103.3.10Patch availableGHSA-7q4h-pj78-j7vg
—org.apache.cxf:apache-cxf (Maven)3.4.0 to before 3.4.33.4.3Patch availableGHSA-7q4h-pj78-j7vg
—org.apache.cxf:apache-cxf (Maven)before 3.3.103.3.10Patch availableGHSA-7q4h-pj78-j7vg
  • Apache CXF VendorApache Affected before 3.4.3; before 3.3.10 Fixed in 3.4.3, 3.3.10 Patch available CNA
  • org.apache.cxf:cxf (Maven) Vendor— Affected 3.4.0 to before 3.4.3 Fixed in 3.4.3 Patch available GHSA-7q4h-pj78-j7vg
  • org.apache.cxf:cxf (Maven) Vendor— Affected before 3.3.10 Fixed in 3.3.10 Patch available GHSA-7q4h-pj78-j7vg
  • org.apache.cxf:apache-cxf (Maven) Vendor— Affected 3.4.0 to before 3.4.3 Fixed in 3.4.3 Patch available GHSA-7q4h-pj78-j7vg
  • org.apache.cxf:apache-cxf (Maven) Vendor— Affected before 3.3.10 Fixed in 3.3.10 Patch available GHSA-7q4h-pj78-j7vg

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*before 3.3.10; 3.4.0 to before 3.4.3VulnerableApache
cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*5.5.0.0.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*5.9.0.0.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*8.0.0 – 8.1.0; 8.2.0 – 8.2.3VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:*8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.0.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.0.0 – 8.2.4VulnerableOracle
  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions before 3.3.10; 3.4.0 to before 3.4.3 Vulnerable ·Apache
  • cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* Versions 5.5.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* Versions 5.9.0.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.1.0; 8.2.0 – 8.2.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* Versions 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4 Vulnerable ·Oracle

Remediation

  • Fix · CNA Apache CXF (Apache Software Foundation) Fixed in 3.4.3, 3.3.10
  • Fix · GHSA-7q4h-pj78-j7vg org.apache.cxf:cxf (Maven) Fixed in 3.4.3 Advisory →
  • Fix · GHSA-7q4h-pj78-j7vg org.apache.cxf:cxf (Maven) Fixed in 3.3.10 Advisory →
  • Fix · GHSA-7q4h-pj78-j7vg org.apache.cxf:apache-cxf (Maven) Fixed in 3.4.3 Advisory →
  • Fix · GHSA-7q4h-pj78-j7vg org.apache.cxf:apache-cxf (Maven) Fixed in 3.3.10 Advisory →

Red Hat 2 advisories

  • RHSA-2022:7273 Released 2022-11-02 · Red Hat rating Moderate
    Red Hat JBoss Web Server 5.7.0 release and security update
    • JWS 5.7.0
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix planned: Will not fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat support for Spring BootAffectedNo fix yet: Fix deferred
JWS 5.7.0Fixed RHSA-2022:7273
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Not affected: 9 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat BPM Suite 6
  • Red Hat Decision Manager 7
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22696
  2. 2026-10-03 Alias added: GHSA-7q4h-pj78-j7vg

References

Patch 2

Advisory 3

Other 13

  • TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
  • TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
  • TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
  • TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences