What is GHSA-4mgg-fqfq-64hg?

GHSA-4mgg-fqfq-64hg is a security advisory published by GitHub Security Advisories with Medium severity. Apache CXF allows unrestricted memory consumption in CXF HTTP clients

Which CVE IDs does GHSA-4mgg-fqfq-64hg cover?

GHSA-4mgg-fqfq-64hg covers the following CVE IDs: CVE-2024-41172. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4mgg-fqfq-64hg?

GHSA-4mgg-fqfq-64hg has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-4mgg-fqfq-64hg?

GHSA-4mgg-fqfq-64hg affects 2 products, including: maven/org.apache.cxf:cxf-rt-transports-http:\u003e= 4.0.0, \u003c 4.0.5; maven/org.apache.cxf:cxf-rt-transports-http:\u003e= 3.6.0, \u003c 3.6.4.

GHSA-4mgg-fqfq-64hgMediumCVSS 3.7

Apache CXF allows unrestricted memory consumption in CXF HTTP clients

Vendor

GitHub Security Advisories

Published

July 19, 2024

Last Modified

November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-41172 →

📋 Description

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

🎯 Affected products2

maven/org.apache.cxf:cxf-rt-transports-http:>= 4.0.0, < 4.0.5
maven/org.apache.cxf:cxf-rt-transports-http:>= 3.6.0, < 3.6.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-41172
https://lists.apache.org/thread/n2hvbrgwpdtcqdccod8by28ynnolybl6
https://github.com/advisories/GHSA-4mgg-fqfq-64hg