CVE-2019-12406

Vulnerability

Description CVE-2019-12406 is a denial-of-service (DoS) vulnerability in Apache CXF, a Java framework for web services. The flaw exists in versions before 3.3.4 and 3.2.11, where the software does not restrict the number of message attachments permitted in a single message. This absence of a limit allows an attacker to exhaust server resources by sending a message with an excessively large number of attachments [1].

Exploitation

Conditions An attacker can exploit this vulnerability by crafting a malicious SOAP or REST message containing a very large number of attachments. No authentication or special network position is required, as the attack can be executed remotely over the network. The only prerequisite is that the target service accepts attachments, which is common in CXF-based applications.

Impact

Successful exploitation leads to a denial-of-service condition. The server may become unresponsive or crash due to resource exhaustion, affecting legitimate users. There is no confidentiality or integrity impact; the vulnerability solely targets availability.

Mitigation

The vulnerability is addressed in Apache CXF versions 3.3.4 and 3.2.11. These releases enforce a default limit of 50 message attachments, which can be configured via the message property "attachment-max-count". Users running older versions should upgrade immediately or apply the configuration change if possible [1].