CVE-2024-32007 — Apache CXF Denial of Service vulnerability in JOSE

Description (CNA)

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache CXF	affected 0 before 4.0.5, 3.6.4, 3.5.9

CWE

CWE-400, CWE-20

References

https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633
https://security.netapp.com/advisory/ntap-20240808-0009/
http://www.openwall.com/lists/oss-security/2024/07/18/3