Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Vulnerability

A vulnerability exists in the JsonMapObjectReaderWriter of Apache CXF, affecting versions prior to 3.4.4 and 3.3.11. An attacker can submit malformed JSON to a web service that processes JSON data through this reader, causing the parsing thread to enter an infinite loop and consume CPU indefinitely [1][2].

Exploitation

An attacker needs network access to the web service and the ability to send HTTP requests with crafted JSON payloads. No authentication or special privileges are required. By sending a specifically malformed JSON object to an endpoint that uses JsonMapObjectReaderWriter, the thread handling the request becomes stuck in an infinite loop [1][2].

Impact

Successful exploitation results in a denial of service (DoS) condition. The affected thread consumes CPU resources without completing, which can degrade performance or exhaust server resources, potentially impacting availability of the service for legitimate users [1][2].

Mitigation

Apache CXF versions 3.4.4 and 3.3.11 contain the fix for this vulnerability. Users should upgrade to these versions or later. No workarounds are provided in the available references [1][2].