Maugin Thomas

**Name of the Vulnerable Software and Affected Versions** Apache CXF versions prior to 3.5.11 Apache CXF versions prior to 3.6.6 Apache CXF versions prior to 4.0.7 Apache CXF versions prior to 4.1.1 **Description** Apache CXF improperly handles large stream-based messages, storing them as temporary files on the local filesystem. A recently introduced bug causes the entire temporary file to be read into memory and then logged. This can be exploited to cause a denial of service by triggering an out-of-memory exception. Additionally, while CXF offers encryption of temporary files to protect sensitive credentials, this bug results in the unencrypted cached files being written to logs. **Recommendations** Upgrade to Apache CXF version 3.5.11 or later. Upgrade to Apache CXF version 3.6.6 or later. Upgrade to Apache CXF version 4.0.7 or later. Upgrade to Apache CXF version 4.1.1 or later.