Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2017-12624

Published: Nov 14, 2017 | Modified: Apr 20, 2025
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
5.3 MODERATE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ubuntu
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2017-12624
CWEhttps://cwe.mitre.org/data/definitions/.html

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property attachment-max-header-size.

Affected Software

NameVendorStart VersionEnd Version
CxfApache3.0.0 (including)3.0.16 (excluding)
CxfApache3.1.0 (including)3.1.14 (excluding)
CxfApache3.2.0 (including)3.2.1 (excluding)
Red Hat JBoss EAP 7.1RedHatcxf*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6RedHateap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el6*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-activemq-artemis-0:1.5.5.013-1.redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-bouncycastle-0:1.56.0-5.redhat_3.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-guava-libraries-0:25.0.0-1.redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-hibernate-0:5.1.15-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-ironjacamar-0:1.4.10-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-jberet-0:1.2.6-2.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-jboss-ejb-client-0:4.0.11-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-jboss-remoting-0:5.0.8-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-jboss-server-migration-0:1.0.6-4.Final_redhat_4.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-mod_cluster-0:1.3.10-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-narayana-0:5.5.32-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-picketlink-bindings-0:2.5.5-13.SP12_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-picketlink-federation-0:2.5.5-13.SP12_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-resteasy-0:3.0.26-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-undertow-0:1.4.18-7.SP8_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-wildfly-0:7.1.4-1.GA_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-wildfly-javadocs-0:7.1.4-2.GA_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-wildfly-naming-client-0:1.0.9-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-wildfly-openssl-linux-0:1.0.6-14.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-wildfly-transaction-client-0:1.0.4-1.Final_redhat_1.1.ep7.el7*
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7RedHateap7-wildfly-web-console-eap-0:2.9.18-1.Final_redhat_1.1.ep7.el7*
Red Hat Single Sign-On 7.2.4 zipRedHatcxf*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use