CVE-2021-30468

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

7.5 HighFix available

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

7.02%Up 5.7 points since Jun 17, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2021-30468
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-400, CWE-835
Updated: 2026-11-02

CVE List No score

Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

Record: CVE-2021-30468
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2022-0592 No score

Record: EUVD-2022-0592
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g23v-p5jq-jvh4 7.5

Infinite loop in Apache CFX

Record: GHSA-g23v-p5jq-jvh4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-835
Updated: 2026-11-02

OSV 7.5

Record: CVE-2021-30468
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-g23v-p5jq-jvh4 7.5

Infinite loop in Apache CFX

Record: GHSA-g23v-p5jq-jvh4
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-835
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.cxf:apache-cxf` Maven	3.4.0 up to 3.4.4	3.4.4
`org.apache.cxf:apache-cxf` Maven	before 3.3.11	3.3.11
`org.apache.cxf:cxf` Maven	3.4.0 up to 3.4.4	3.4.4
`org.apache.cxf:cxf` Maven	before 3.3.11	3.3.11
`org.apache.cxf:apache-cxf` Maven	3.4.0 up to 3.4.4, plus listed versions 3.4.13.4.23.4.3	3.4.4
`org.apache.cxf:apache-cxf` Maven	before 3.3.11, plus listed versions 2.0.102.0.112.0.122.0.132.0.6 Show 45 moreShow less 2.0.72.0.82.0.92.12.1.12.1.102.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.22.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.22.4.32.4.4	3.3.11
`org.apache.cxf:cxf` Maven	3.4.0 up to 3.4.4, plus listed versions 3.4.13.4.23.4.3	3.4.4
`org.apache.cxf:cxf` Maven	before 3.3.11, plus listed versions 2.0.102.0.112.0.122.0.132.0.6 Show 45 moreShow less 2.0.72.0.82.0.92.12.1.12.1.102.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.22.2.12.2.102.2.112.2.122.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.12.3.102.3.112.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.102.4.22.4.32.4.4	3.3.11

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-30468 is a high vulnerability (CVSS 7.5) in Apache Cxf, published June 16, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.02%, the 94th percentile. Fixed in org.apache.cxf:apache-cxf 3.4.4.

References

Show 21 moreShow less

This page doesn't list everything

Left out here: 236 versions. The JSON record has them.