org.apache.cxf:cxf-core@4.1.6
latest version
4.2.2
latest non vulnerable version
first published
12 years ago
latest version published
25 days ago
licenses detected
- [3.0.0-milestone1,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.cxf:cxf-core package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection due to improper configuration of the How to fix XML External Entity (XXE) Injection? Upgrade | [,4.1.7)[4.2.0,4.2.2) |
org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of restriction on the number of attachment headers during message deserialization. An attacker can exhaust system resources and cause service disruption by sending messages with an excessive number of attachment headers. How to fix Allocation of Resources Without Limits or Throttling? Upgrade | [,4.1.7)[4.2.0,4.2.2) |