CVE-2024-29736
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
- Record
CVE-2024-29736- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
CVE List
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
- Record
CVE-2024-29736- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2024-2270
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
- Record
EUVD-2024-2270- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5m3j-pxh7-455p
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
- Record
GHSA-5m3j-pxh7-455p- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSV
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
- Record
CVE-2024-29736- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-5m3j-pxh7-455p
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured.
- Record
GHSA-5m3j-pxh7-455p- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVCLSA-2026-1776040410 No score
TuxCare security update for org.apache.cxf (6 CVEs)
TuxCare rebuilt 5 org.apache.cxf packages to address 6 CVEs. Fixed in 3.4.5-tuxcare.1.
- Record
CLSA-2026-1776040410- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-service-descriptionMaven |
4.0.0 up to 4.0.5 | 4.0.5 |
org.apache.cxf:cxf-rt-rs-service-descriptionMaven |
3.6.0 up to 3.6.4 | 3.6.4 |
org.apache.cxf:cxf-rt-rs-service-descriptionMaven |
before 3.5.9 | 3.5.9 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-databinding-aegisTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-security-joseTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-service-descriptionTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-service-descriptionMaven |
4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.24.0.34.0.4 |
4.0.5 |
org.apache.cxf:cxf-rt-rs-service-descriptionMaven |
3.6.0 up to 3.6.4, plus listed versions 3.6.13.6.23.6.3 |
3.6.4 |
org.apache.cxf:cxf-rt-rs-service-descriptionMaven |
before 3.5.9, plus listed versions 3.0.03.0.0-milestone13.0.0-milestone23.0.13.0.10 Show 45 moreShow less3.0.113.0.123.0.133.0.143.0.153.0.163.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.6 |
3.5.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29736 is a critical vulnerability (CVSS 9.1) in Apache Cxf, published July 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 64th percentile. Fixed in org.apache.cxf:cxf-rt-rs-service-description 4.0.5.
References
lists.apache.org/thread/4jtpsswn2r6xommol54p5mg263ysgdw2
openwall.com/lists/oss-security/2024/07/18/2
security.netapp.com/advisory/ntap-20241115-0003
nvd.nist.gov/vuln/detail/CVE-2024-29736
github.com/apache/cxf/commit/378afe1acb7503315bc63555c8743db0f55d8312
Left out here: 37 versions. The JSON record has them.