CVE-2025-48795: Apache CXF Denial of Service Vulnerability Due to Improper File Handling
Summary
CVE-2025-48795: Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged. Affects org.apache.cxf:cxf-core across 4 version ranges.
< 3.5.11
>= 3.6.0, < 3.6.6
>= 4.0.0, < 4.0.7
>= 4.1.0, < 4.1.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CXF is an open-source services framework that helps developers build and develop web services. It provides a robust environment for creating SOAP and RESTful services, offering features such as data binding, security, and transaction management. However, a recent vulnerability has been identified that affects its ability to handle large stream-based messages securely.
Vulnerability Detail
Apache CXF contains a vulnerability where large stream-based messages are stored as temporary files on the local filesystem. A bug was introduced that causes the entire temporary file to be read into memory and logged, potentially leading to a denial of service (DoS) attack. An attacker could exploit this flaw to trigger an out-of-memory exception, causing the application to crash. Additionally, sensitive credentials may be logged in an unencrypted format, posing a security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.113.5.11 -
>= 3.6.0, < 3.6.63.6.6 -
>= 4.0.0, < 4.0.74.0.7 -
>= 4.1.0, < 4.1.14.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can limit the size of the files being processed or implement additional logging controls to prevent sensitive information from being logged. However, upgrading to the latest version is the recommended approach.
Conclusion
In summary, CVE-2025-48795 is a significant vulnerability in Apache CXF that can lead to denial of service attacks and potential exposure of sensitive information. Users are strongly advised to upgrade to the latest patched versions to mitigate these risks.
See every vulnerability recorded for org.apache.cxf:cxf-core →
FAQ
CVE-2025-48795 is a vulnerability in Apache CXF that allows for denial of service attacks due to improper handling of large temporary files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The primary risk is a denial of service attack, which can crash the application by exhausting memory resources. Additionally, sensitive data may be logged unencrypted.
The safe versions that contain the fix for this vulnerability are 3.5.11, 3.6.6, 4.0.7, and 4.1.1.
The CVSS score for this vulnerability is 5.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.cxf:cxf-core.
