Every CVE Search/ Get API key

CVE-2013-2160

Missing XML Validation in Apache CXF

5.0 MediumPublic exploitFix available

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Exploit likelihood

32.3%Down 6.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Record
CVE-2013-2160
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Record
CVE-2013-2160
Updated
2026-11-02
EUVDEUVD-2022-1906 No score

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Record
EUVD-2022-1906
Updated
2026-11-03
GitHub AdvisoriesGHSA-254q-rp36-v2m8 No score

Missing XML Validation in Apache CXF

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Record
GHSA-254q-rp36-v2m8
Weakness
CWE-112
Updated
2026-11-02
OSVGHSA-254q-rp36-v2m8 No score

Missing XML Validation in Apache CXF

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

Record
GHSA-254q-rp36-v2m8
Weakness
CWE-112
Updated
2026-11-02
OSVMGASA-2014-0001 No score

Updated cxf, wss4j, and jacorb packages fix security vulnerability

Multiple denial of service flaws were found in the way StAX parser implementation of Apache CXF, an open-source web services framework, performed processing of certain XML files. If a web service application utilized the services of the StAX parser, a remote attacker could provide a specially-crafted XML file that, when processed by the application would lead to excessive system resources (CPU cycles, memory) consumption by that application (CVE-2013-2160).

Record
MGASA-2014-0001
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.cxf:cxf-rt-frontend-jaxrs
Maven
 2.5.0 up to 2.5.10
2.5.10
org.apache.cxf:cxf-rt-frontend-jaxrs
Maven
 2.6.0 up to 2.6.7
2.6.7
org.apache.cxf:cxf-rt-frontend-jaxrs
Maven
 2.7.0 up to 2.7.4
2.7.4
org.apache.cxf:cxf-rt-frontend-jaxrs
Maven
 2.5.0 up to 2.5.10, plus listed versions
2.5.12.5.22.5.32.5.42.5.5
Show 4 moreShow less
2.5.62.5.72.5.82.5.9
2.5.10
org.apache.cxf:cxf-rt-frontend-jaxrs
Maven
 2.6.0 up to 2.6.7, plus listed versions
2.6.12.6.22.6.32.6.42.6.52.6.6
2.6.7
org.apache.cxf:cxf-rt-frontend-jaxrs
Maven
 2.7.0 up to 2.7.4, plus listed versions
2.7.12.7.22.7.3
2.7.4
cxf
Mageia:3
 before 2.6.9-1.mga3
2.6.9-1.mga3
jacorb
Mageia:3
 before 2.3.1-4.mga3
2.3.1-4.mga3
wss4j
Mageia:3
 before 1.6.10-1.mga3
1.6.10-1.mga3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBApache CXF < 2.5.10/2.6.7/2.7.4 - Denial of Service2013-07-09

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2160 is a medium vulnerability (CVSS 5.0) in Apache Cxf, published August 19, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 32.3%, the 98th percentile. Fixed in org.apache.cxf:cxf-rt-frontend-jaxrs 2.5.10.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open