CVE-2024-32007 Apache CXF Denial of Service vulnerability in JOSE
An attacker can cause a denial of service in Apache CXF by sending a token with an excessively large p2c parameter value.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32007?
CVE-2024-32007 is a high-severity denial of service vulnerability in Apache Cxf, published on 19 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
Which versions are affected by CVE-2024-32007?
6 open source packages ship an affected version, including org.apache.cxf:cxf-rt-rs-security-jose. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-jose Maven | All versions | 3.5.9 |
org.apache.cxf:cxf-rt-rs-security-jose Maven | All versions | 3.5.9 |
org.apache.cxf:cxf-rt-rs-security-jose Maven | From 3.6.0 | 3.6.4 |
org.apache.cxf:cxf-rt-rs-security-jose Maven | From 3.6.0 | 3.6.4 |
org.apache.cxf:cxf-rt-rs-security-jose Maven | From 4.0.0 | 4.0.5 |
org.apache.cxf:cxf-rt-rs-security-jose Maven | From 4.0.0 | 4.0.5 |
Products include Apache Cxf.
How do I fix CVE-2024-32007?
Upgrade org.apache.cxf:cxf-rt-rs-security-jose to a fixed version for your release line: 3.5.9, 3.6.4 or 4.0.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-32007 being exploited?
There is no known exploitation of CVE-2024-32007 in the wild and no public exploit code.
Other vulnerabilities in Apache Cxf
- CVE-2012-2379 XML Signature/Encryption Not Validated in Apache CXF
- CVE-2026-66909 Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage
- CVE-2026-68079 Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay
- CVE-2026-50628 Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
- CVE-2025-48913 Apache CXF: Untrusted JMS configuration can lead to RCE
Sources
Also known as GHSA-6pff-fmh2-4mmf.