CVE-2024-32007
Apache CXF Denial of Service vulnerability in JOSE
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
- Record
CVE-2024-32007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
CVE List
Apache CXF Denial of Service vulnerability in JOSE
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
- Record
CVE-2024-32007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-2281
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
- Record
EUVD-2024-2281- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6pff-fmh2-4mmf
Apache CXF Denial of Service vulnerability in JOSE
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
- Record
GHSA-6pff-fmh2-4mmf- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Apache CXF Denial of Service vulnerability in JOSE
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
- Record
CVE-2024-32007- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-400
- Updated
- 2026-11-02
OSVGHSA-6pff-fmh2-4mmf
Apache CXF Denial of Service vulnerability in JOSE
An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.
- Record
GHSA-6pff-fmh2-4mmf- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVCLSA-2026-1776040410 No score
TuxCare security update for org.apache.cxf (6 CVEs)
TuxCare rebuilt 5 org.apache.cxf packages to address 6 CVEs. Fixed in 3.4.5-tuxcare.1.
- Record
CLSA-2026-1776040410- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cxf:cxf-rt-rs-security-joseMaven |
4.0.0 up to 4.0.5 | 4.0.5 |
org.apache.cxf:cxf-rt-rs-security-joseMaven |
3.6.0 up to 3.6.4 | 3.6.4 |
org.apache.cxf:cxf-rt-rs-security-joseMaven |
before 3.5.9 | 3.5.9 |
org.apache.cxf:cxf-coreTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-databinding-aegisTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-security-joseTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-service-descriptionTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-transports-jmsTuxCare:Maven From an advisory covering 6 CVEs |
3.4.5 up to 3.4.5-tuxcare.1 | 3.4.5-tuxcare.1 |
org.apache.cxf:cxf-rt-rs-security-joseMaven |
4.0.0 up to 4.0.5, plus listed versions 4.0.14.0.24.0.34.0.4 |
4.0.5 |
org.apache.cxf:cxf-rt-rs-security-joseMaven |
3.6.0 up to 3.6.4, plus listed versions 3.6.13.6.23.6.3 |
3.6.4 |
org.apache.cxf:cxf-rt-rs-security-joseMaven |
before 3.5.9, plus listed versions 3.0.103.0.113.0.123.0.133.0.14 Show 45 moreShow less3.0.153.0.163.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.0 |
3.5.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-32007 is a high vulnerability (CVSS 7.5) in Apache Cxf, published July 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. Fixed in org.apache.cxf:cxf-rt-rs-security-jose 4.0.5.
References
lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633
security.netapp.com/advisory/ntap-20240808-0009
openwall.com/lists/oss-security/2024/07/18/3
nvd.nist.gov/vuln/detail/CVE-2024-32007
github.com/apache/cxf/commit/20793d3fed2e73e2785a58ec5b47403306ae4a5c
Left out here: 33 versions. The JSON record has them.