CVE-2017-12624 Improper Input Validation in Apache CXF
Attackers can cause denial of service in Apache CXF web services by sending crafted message attachment headers exceeding default size limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-12624?
CVE-2017-12624 is a medium-severity denial of service vulnerability in Apache Cxf, published on 14 Nov 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
Which versions are affected by CVE-2017-12624?
6 open source packages ship an affected version, including org.apache.cxf:cxf-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cxf:cxf-core Maven | All versions | 3.0.16 |
org.apache.cxf:cxf-core Maven | All versions | 3.0.16 |
org.apache.cxf:cxf-core Maven | From 3.1.0 | 3.1.14 |
org.apache.cxf:cxf-core Maven | From 3.1.0 | 3.1.14 |
org.apache.cxf:cxf-core Maven | From 3.2.0 | 3.2.1 |
org.apache.cxf:cxf-core Maven | From 3.2.0 | 3.2.1 |
Products include Apache Cxf.
How do I fix CVE-2017-12624?
Upgrade org.apache.cxf:cxf-core to a fixed version for your release line: 3.0.16, 3.1.14 or 3.2.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-12624 being exploited?
There is no known exploitation of CVE-2017-12624 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-7vgj-8mw4-hg8r.