CVE-2015-5175: Apache CXF Fediz application plugins Denial of Service (DoS) vulnerability
Summary
CVE-2015-5175: Apache CXF Fediz application plugins are vulnerable to Denial of Service (DoS) attacks. Affects org.apache.cxf.fediz:fediz-idp across 2 version ranges.
< 1.1.3
>= 1.2, < 1.2.1
Fixed in 1.1.3 or 1.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache CXF Fediz is an open-source Identity Provider (IdP) and Security Token Service (STS) that enables web applications to use various Single Sign-On (SSO) protocols. It provides support for SAML, WS-Federation, and WS-Trust. The 'org.apache.cxf.fediz:fediz-spring2' package is a plugin for integrating Fediz with Spring applications.
Vulnerability Detail
The Apache CXF Fediz application plugins prior to version 1.1.3 and 1.2.x prior to 1.2.1 are vulnerable to Denial of Service (DoS) attacks. This vulnerability allows remote attackers to create a denial of service, potentially disrupting the availability of the affected application. The vulnerability is assigned the CVE identifier CVE-2015-5175 and has a CVSS score of 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How To Fix
Latest published version: 1.7.2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.31.1.3 -
>= 1.2, < 1.2.11.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The Apache CXF Fediz application plugins are vulnerable to a Denial of Service (DoS) attack. It is crucial to upgrade to the recommended versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.cxf.fediz:fediz-idp →
FAQ
Apache CXF Fediz is an open-source Identity Provider (IdP) and Security Token Service (STS) that enables web applications to use various Single Sign-On (SSO) protocols.
This vulnerability allows remote attackers to create a denial of service, potentially disrupting the availability of the affected application.
The CVE identifier for this vulnerability is CVE-2015-5175.
The CVSS score of this vulnerability is 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
To fix this vulnerability, it is recommended to upgrade to Apache CXF Fediz version 1.1.3 or later for applications using the 'org.apache.cxf.fediz:fediz-spring2' package. For applications using version 1.2.x, it is advised to upgrade to version 1.2.1 or later.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
