CVE-2019-12406 Potential DOS attack due to unrestricted attachment count in messages
Attackers can cause denial of service by sending messages with excessive attachments, requiring an upgrade to Apache CXF.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-12406?
CVE-2019-12406 is a medium-severity denial of service vulnerability in Apache Cxf, published on 6 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Weakness: CWE-770
Which versions are affected by CVE-2019-12406?
8 open source packages ship an affected version, including org.apache.cxf:apache-cxf and org.apache.cxf:cxf. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cxf:apache-cxf Maven | All versions | 3.2.11 |
org.apache.cxf:apache-cxf Maven | All versions | 3.2.11 |
org.apache.cxf:apache-cxf Maven | From 3.3.0 | 3.3.4 |
org.apache.cxf:apache-cxf Maven | From 3.3.0 | 3.3.4 |
org.apache.cxf:cxf Maven | All versions | 3.2.11 |
org.apache.cxf:cxf Maven | All versions | 3.2.11 |
2 more packages
org.apache.cxf:cxf Maven | From 3.3.0 | 3.3.4 |
org.apache.cxf:cxf Maven | From 3.3.0 | 3.3.4 |
Products include Apache Cxf, Oracle Commerce Guided Search, Oracle Flexcube Private Banking, Oracle Retail Order Broker.
How do I fix CVE-2019-12406?
Upgrade org.apache.cxf:apache-cxf to a fixed version for your release line: 3.2.11 or 3.3.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-12406 being exploited?
There is no known exploitation of CVE-2019-12406 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-58p8-9g59-q2hr.