Read the docs
TI-2024-21106 Aliases CVE-2024-32007GHSA-6pff-fmh2-4mmf

Apache CXF Denial of Service vulnerability in JOSE

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01314 70th percentileScored 2026-11-08
Fix Partial Apache CXF (Apache Software Foundation): 4.0.5, 3.6.4, 3.5.9org.apache.cxf:cxf-rt-rs-security-jose (Maven): 4.0.5, 3.6.4, 3.5.9Red Hat: 3 advisoriesRed Hat: 3 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache CXFbefore 4.0.5, 3.6.4, 3.5.94.0.5, 3.6.4, 3.5.9Patch availableCNA
—org.apache.cxf:cxf-rt-rs-security-jose (Maven)4.0.0 to before 4.0.54.0.5Patch availableGHSA-6pff-fmh2-4mmf
—org.apache.cxf:cxf-rt-rs-security-jose (Maven)3.6.0 to before 3.6.43.6.4Patch availableGHSA-6pff-fmh2-4mmf
—org.apache.cxf:cxf-rt-rs-security-jose (Maven)before 3.5.93.5.9Patch availableGHSA-6pff-fmh2-4mmf
  • Apache CXF VendorApache Affected before 4.0.5, 3.6.4, 3.5.9 Fixed in 4.0.5, 3.6.4, 3.5.9 Patch available CNA
  • org.apache.cxf:cxf-rt-rs-security-jose (Maven) Vendor— Affected 4.0.0 to before 4.0.5 Fixed in 4.0.5 Patch available GHSA-6pff-fmh2-4mmf
  • org.apache.cxf:cxf-rt-rs-security-jose (Maven) Vendor— Affected 3.6.0 to before 3.6.4 Fixed in 3.6.4 Patch available GHSA-6pff-fmh2-4mmf
  • org.apache.cxf:cxf-rt-rs-security-jose (Maven) Vendor— Affected before 3.5.9 Fixed in 3.5.9 Patch available GHSA-6pff-fmh2-4mmf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*before 3.5.9; 3.6.0 to before 3.6.4; 4.0.0 to before 4.0.5VulnerableApache
  • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:* Versions before 3.5.9; 3.6.0 to before 3.6.4; 4.0.0 to before 4.0.5 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache CXF (Apache Software Foundation) Fixed in 4.0.5, 3.6.4, 3.5.9
  • Fix · GHSA-6pff-fmh2-4mmf org.apache.cxf:cxf-rt-rs-security-jose (Maven) Fixed in 4.0.5 Advisory →
  • Fix · GHSA-6pff-fmh2-4mmf org.apache.cxf:cxf-rt-rs-security-jose (Maven) Fixed in 3.6.4 Advisory →
  • Fix · GHSA-6pff-fmh2-4mmf org.apache.cxf:cxf-rt-rs-security-jose (Maven) Fixed in 3.5.9 Advisory →

Red Hat 3 advisories

  • RHSA-2024:7052 Released 2024-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.4 for Quarkus 3.8 update is now available (RHBQ 3.8.6.GA)
    • Red Hat build of Apache Camel 4 for Quarkus 3
  • RHSA-2024:6883 Released 2024-09-19 · Red Hat rating Important
    Red Hat Build of Apache Camel 3.20.7 for Spring Boot security update.
    • Red Hat build of Apache Camel 3.20.7 for Spring Boot
  • RHSA-2024:2707 Released 2024-05-06 · Red Hat rating Important
    Red Hat Build of Apache Camel security update
    • Red Hat build of Apache Camel 4.4.0 for Spring Boot

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat build of QuarkusAffectedNo fix planned: Will not fix
Red Hat build of Apache Camel 3.20.7 for Spring BootFixed RHSA-2024:6883
Red Hat build of Apache Camel 4 for Quarkus 3Fixed RHSA-2024:7052
Red Hat build of Apache Camel 4.4.0 for Spring BootFixed RHSA-2024:2707
Not affected: 3 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-32007
  2. 2026-10-03 Alias added: GHSA-6pff-fmh2-4mmf

References

Advisory 2

Other 4

  • TI-2019-09264 Incorrect authorization in Apache CXF CVSS 3.1CRITICAL 9.8
  • TI-2020-10930 Apache CXF Reflected XSS in the services listing page via the styleSheetPath CVSS 3.1MEDIUM 6.1
  • TI-2010-01990 Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in… CVSS 3.1CRITICAL 9.8
  • TI-2022-22907 Apache CXF SSRF Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-47481 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage CVSS 3.1CRITICAL 9.8
  • TI-2025-31053 Apache CXF: Untrusted JMS configuration can lead to RCE CVSS 3.1CRITICAL 9.8
See all 79 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences