CVE-2024-41172

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 3.6.3 and earlier, 4.0.4 and earlier

Description: The issue is related to a memory leak in the Apache CXF HTTP client conduit, which can prevent HTTPClient instances from being garbage collected. This can cause memory consumption to increase over time, potentially leading to the application running out of memory. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations: For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. For versions prior to 4.0.5, update to version 4.0.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HTTP client conduit to minimize the risk of exploitation.