VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 30, 2014· Updated Jun 17, 2026

CVE-2014-3584

CVE-2014-3584

Description

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.cxf:cxf-rt-frontend-jaxrsMaven
>= 2.5.0, < 2.6.112.6.11
org.apache.cxf:cxf-rt-frontend-jaxrsMaven
>= 2.7.0, < 2.7.82.7.8
org.apache.cxf:cxf-rt-frontend-jaxrsMaven
>= 3.0.0, < 3.0.13.0.1

Affected products

12
  • Apache/Cxf11 versions
    cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:apache:cxf:*:*:*:*:*:*:*:*range: <=2.6.10
    • cpe:2.3:a:apache:cxf:2.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:2.7.7:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:cxf:3.0.0:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxrs
    Range: >= 2.5.0, < 2.6.11

Patches

Vulnerability mechanics

References

22

News mentions

0

No linked articles in our index yet.