Not rated
CVE-2021-30468 A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web…
Description
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache CXF 3.4 | earliest → < 3.4.4 | 3.4.4 |
References
- cxf.apache.org cxf.apache.org
- [cxf-users] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter lists.apache.org
- [cxf-dev] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter lists.apache.org
- [announce] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter lists.apache.org
- [oss-security] 20210616 CVE-2021-30468: Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter www.openwall.com
- [tomee-commits] 20210705 [jira] [Created] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- [tomee-commits] 20210705 [jira] [Updated] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- [tomee-commits] 20210901 [jira] [Resolved] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- [tomee-commits] 20210901 [jira] [Commented] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- [tomee-commits] 20210913 [jira] [Commented] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- [tomee-commits] 20210913 [jira] [Updated] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- [tomee-commits] 20210913 [jira] [Reopened] (TOMEE-3768) TomEE plus is affected by CVE-CVE-2021-30468 vulnerability related to Apache CXF lists.apache.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of Apache CXF
The 56 CVEs of Apache CXF →
CVE-2026-108039
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML…
Not rated
CVE-2026-107938
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the…
Not rated
CVE-2026-107937
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured…
Not rated
CVE-2026-100227
Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
Not rated