Denial of Service Vulnerability in Apache CXF by The Apache Software Foundation
CVE-2019-12406

6.5MEDIUM

Key Information:

Vendor: Apache
Status: Apache Cxf
Vendor: CVE Published:; 6 November 2019

What is CVE-2019-12406?

Apache CXF versions before 3.3.4 and 3.2.11 lack controls on the number of message attachments allowed in a single message. This flaw can be exploited by an attacker who sends a large number of attachments, potentially leading to service outages or disruptions. The subsequent releases enforce a default limit of 50 attachments to curb this risk, and this limit can be adjusted via the message property 'attachment-max-count'.