Apache CXF: Denial of Service vulnerability with temporary files

Vulnerability

Description In Apache CXF versions prior to 3.5.10, 3.6.5, and 4.0.6, the CachedOutputStream class may fail to close its underlying temporary files in certain edge cases. The root cause lies in the maybeDeleteTempFile method, which does not always remove streams from its internal list correctly, especially under high concurrency [3].

Exploitation

An attacker can exploit this by sending a large number of requests that trigger the caching mechanism, causing temporary files to accumulate on the server or client file system. No special authentication is required if the service is accessible; the vulnerability applies to both server and client contexts [1].

Impact

Over time, the accumulation of temporary files can exhaust disk space, leading to a denial of service (DoS) condition. This affects the availability of the system but does not expose data or allow code execution [1].

Mitigation

The vulnerability is fixed in Apache CXF versions 3.5.10, 3.6.5, and 4.0.6. The fix refactors the cleaner implementation and adds guardrails to ensure temporary files are properly deleted [4]. Users should upgrade to these versions or later.