VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published May 8, 2014· Updated May 6, 2026

CVE-2014-0109

CVE-2014-0109

Description

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cxf:cxf-coreMaven
< 2.6.142.6.14
org.apache.cxf:cxf-coreMaven
>= 2.7.0, < 2.7.112.7.11

Affected products

43
  • Apache/Cxf43 versions
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*+ 42 more
    • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <=2.6.13
    • cpe:2.3:a:apache:cxf:2.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.4.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.11:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.12:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.6.9:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.9:*:*:*:*:*:*:*

Patches

2
a5f907b1da89

Update StaxInInterceptor to just create a html error message on the client side as the normal error handling works best on server side.

https://github.com/apache/cxfDaniel KulpFeb 19, 2014via ghsa
commit
1 file changed · +15 −4
  • api/src/main/java/org/apache/cxf/interceptor/StaxInInterceptor.java+15 −4 modified
    @@ -21,6 +21,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.io.Reader;
 import java.util.HashMap;
 import java.util.List;
@@ -36,8 +37,8 @@
 import org.apache.cxf.common.util.StringUtils;
 import org.apache.cxf.helpers.CastUtils;
 import org.apache.cxf.helpers.HttpHeaderHelper;
-import org.apache.cxf.helpers.IOUtils;
 import org.apache.cxf.message.Message;
+import org.apache.cxf.message.MessageUtils;
 import org.apache.cxf.phase.AbstractPhaseInterceptor;
 import org.apache.cxf.phase.Phase;
 import org.apache.cxf.staxutils.StaxUtils;
@@ -73,10 +74,20 @@ public void handleMessage(Message message) {
         }
         String contentType = (String)message.get(Message.CONTENT_TYPE);
         
-        if (contentType != null && contentType.contains("text/html")) {
-            String htmlMessage = null;
+        if (contentType != null 
+            && contentType.contains("text/html")
+            && MessageUtils.isRequestor(message)) {
+            StringBuilder htmlMessage = new StringBuilder(1024);
             try {
-                htmlMessage = IOUtils.toString(is, 500);
+                if (reader == null) {
+                    reader = new InputStreamReader(is, (String)message.get(Message.ENCODING));
+                }
+                char s[] = new char[1024];
+                int i = reader.read(s);
+                while (htmlMessage.length() < 64536 && i > 0) {
+                    htmlMessage.append(s, 0, i);
+                    i = reader.read(s);
+                }
             } catch (IOException e) {
                 throw new Fault(new org.apache.cxf.common.i18n.Message("INVALID_HTML_RESPONSETYPE",
                         LOG, "(none)"));
6dd839afbb4d

Update StaxInInterceptor to just create a html error message on the client side as the normal error handling works best on server side.

https://github.com/apache/cxfDaniel KulpFeb 19, 2014via ghsa
commit
1 file changed · +15 −4
  • api/src/main/java/org/apache/cxf/interceptor/StaxInInterceptor.java+15 −4 modified
    @@ -21,6 +21,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.io.Reader;
 import java.util.HashMap;
 import java.util.List;
@@ -36,8 +37,8 @@
 import org.apache.cxf.common.util.StringUtils;
 import org.apache.cxf.helpers.CastUtils;
 import org.apache.cxf.helpers.HttpHeaderHelper;
-import org.apache.cxf.helpers.IOUtils;
 import org.apache.cxf.message.Message;
+import org.apache.cxf.message.MessageUtils;
 import org.apache.cxf.phase.AbstractPhaseInterceptor;
 import org.apache.cxf.phase.Phase;
 import org.apache.cxf.staxutils.StaxUtils;
@@ -73,10 +74,20 @@ public void handleMessage(Message message) {
         }
         String contentType = (String)message.get(Message.CONTENT_TYPE);
         
-        if (contentType != null && contentType.contains("text/html")) {
-            String htmlMessage = null;
+        if (contentType != null 
+            && contentType.contains("text/html")
+            && MessageUtils.isRequestor(message)) {
+            StringBuilder htmlMessage = new StringBuilder(1024);
             try {
-                htmlMessage = IOUtils.toString(is, 500);
+                if (reader == null) {
+                    reader = new InputStreamReader(is, (String)message.get(Message.ENCODING));
+                }
+                char s[] = new char[1024];
+                int i = reader.read(s);
+                while (htmlMessage.length() < 64536 && i > 0) {
+                    htmlMessage.append(s, 0, i);
+                    i = reader.read(s);
+                }
             } catch (IOException e) {
                 throw new Fault(new org.apache.cxf.common.i18n.Message("INVALID_HTML_RESPONSETYPE",
                         LOG, "(none)"));

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

22

News mentions

0

No linked articles in our index yet.