Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
Priority MEDIUM 43CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Why it matters now
EPSS 0.07024 94th percentileScored 2026-11-07
Fix Partial Apache CXF (Apache Software Foundation): 3.4.4org.apache.cxf:apache-cxf (Maven): 3.4.4, 3.3.11+1 more productRed Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache CXF | Apache CXF to before 3.4.4 | 3.4.4 | Patch available | CNA |
| — | org.apache.cxf:apache-cxf (Maven) | 3.4.0 to before 3.4.4 | 3.4.4 | Patch available | GHSA-g23v-p5jq-jvh4 |
| — | org.apache.cxf:apache-cxf (Maven) | before 3.3.11 | 3.3.11 | Patch available | GHSA-g23v-p5jq-jvh4 |
| — | org.apache.cxf:cxf (Maven) | 3.4.0 to before 3.4.4 | 3.4.4 | Patch available | GHSA-g23v-p5jq-jvh4 |
| — | org.apache.cxf:cxf (Maven) | before 3.3.11 | 3.3.11 | Patch available | GHSA-g23v-p5jq-jvh4 |
- Apache CXF VendorApache Affected Apache CXF to before 3.4.4 Fixed in 3.4.4 Patch available CNA
- org.apache.cxf:apache-cxf (Maven) Vendor— Affected 3.4.0 to before 3.4.4 Fixed in 3.4.4 Patch available GHSA-g23v-p5jq-jvh4
- org.apache.cxf:apache-cxf (Maven) Vendor— Affected before 3.3.11 Fixed in 3.3.11 Patch available GHSA-g23v-p5jq-jvh4
- org.apache.cxf:cxf (Maven) Vendor— Affected 3.4.0 to before 3.4.4 Fixed in 3.4.4 Patch available GHSA-g23v-p5jq-jvh4
- org.apache.cxf:cxf (Maven) Vendor— Affected before 3.3.11 Fixed in 3.3.11 Patch available GHSA-g23v-p5jq-jvh4
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* | before 3.3.11; 3.4.0 to before 3.4.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomee:8.0.6:*:*:*:*:*:*:* | 8.0.6 | Vulnerable | Apache |
| cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* | 5.5.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* | 5.9.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* | 12.2.1.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* | 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | Oracle |
- cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions before 3.3.11; 3.4.0 to before 3.4.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomee:8.0.6:*:*:*:*:*:*:* Versions 8.0.6 Vulnerable ·Apache
- cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:* Versions 5.5.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* Versions 5.9.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* Versions 8.2.2 Vulnerable ·Oracle
- cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache CXF (Apache Software Foundation) Fixed in 3.4.4
- Fix · GHSA-g23v-p5jq-jvh4 org.apache.cxf:apache-cxf (Maven) Fixed in 3.4.4 Advisory →
- Fix · GHSA-g23v-p5jq-jvh4 org.apache.cxf:apache-cxf (Maven) Fixed in 3.3.11 Advisory →
- Fix · GHSA-g23v-p5jq-jvh4 org.apache.cxf:cxf (Maven) Fixed in 3.4.4 Advisory →
- Fix · GHSA-g23v-p5jq-jvh4 org.apache.cxf:cxf (Maven) Fixed in 3.3.11 Advisory →
Red Hat 3 advisories
- RHSA-2022:7273 Released 2022-11-02 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.0 release and security update
- JWS 5.7.0
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:3205 Released 2021-08-18 · Red Hat rating ModerateRed Hat Integration Camel-K 1.4 release and security update
- Red Hat Integration
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Out of support scope |
| JWS 5.7.0 | Fixed | RHSA-2022:7273 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Integration | Fixed | RHSA-2021:3205 |
Not affected: 12 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat BPM Suite 6
- Red Hat Decision Manager 7
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss SOA Platform 5
- Red Hat Process Automation 7
- Red Hat Single Sign-On 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-30468
- 2026-10-03 Alias added: GHSA-g23v-p5jq-jvh4
References
Patch 2
Advisory 4
- http://cxf.apache.org/security-advisories.data/CVE-2021-30468.txt.asc
- [oss-security] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
- https://security.netapp.com/advisory/ntap-20210917-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2021-30468
Other 21
- [cxf-users] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
- [cxf-dev] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
- [announce] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
- [tomee-commits] 20210705 [jira] [Created] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- [tomee-commits] 20210705 [jira] [Updated] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- [tomee-commits] 20210901 [jira] [Resolved] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- [tomee-commits] 20210901 [jira] [Commented] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- [tomee-commits] 20210913 [jira] [Commented] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- [tomee-commits] 20210913 [jira] [Updated] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- [tomee-commits] 20210913 [jira] [Reopened] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF
- https://lists.apache.org/thread.html/r3f46ae38e4a6e80c069cdb320e0ce831b0a21a12ef0cc92c0943f34a@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r4771084730c4cf6e59eda60b4407122c86f174eb750b24f610ba9ff4@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459@%3Cdev.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r4a4b6bc0520b69c18d2a59daa6af84ae49f0c22164dccb8538794459@%3Cusers.cxf.apache.org%3E
- https://lists.apache.org/thread.html/r54c0f1cbbb9f381dfbedb9ea5e90ecb1c0a15371f40c4b10322ac737@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/ra833f78b3fa577cb43558cf343859a1bf70b1c5ce2353b3877d96422@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/rac07822057521dccf33ab5d136e0e8c599a6e2c8ac75e44ffbdc6e07@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/re5b2a2b77faa22684d47bd2ac6623135c615565328ff40a1ec705448@%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/re9e05c6cab5f0dcc827eba4e6fcf26fa0b493e7ca84d62c867a80d03@%3Ccommits.tomee.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210917-0002
More Apache Cxf vulnerabilities
- TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
- TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
- TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
- TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
- TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-30468 · CVE Program
- CVE-2021-30468 · NVD
- FIRST EPSS
- GHSA-g23v-p5jq-jvh4 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-30468 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences