CVE-2017-12624

Improper Input Validation in Apache CXF

5.5 MediumPublic exploitFix available

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.70%Down 29.3 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

Record: CVE-2017-12624
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-12624
Updated: 2026-11-02

EUVDEUVD-2022-3066 No score

Record: EUVD-2022-3066
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7vgj-8mw4-hg8r 5.5

Improper Input Validation in Apache CXF

Record: GHSA-7vgj-8mw4-hg8r
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSV 5.5

Record: CVE-2017-12624
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-7vgj-8mw4-hg8r 5.5

Improper Input Validation in Apache CXF

Record: GHSA-7vgj-8mw4-hg8r
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-20
Updated: 2026-11-02

OSVRHSA-2018:2423 7.6

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 security update

Record: RHSA-2018:2423
CVSS 3.0: 7.6 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-02

OSVRHSA-2018:2424 7.6

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update

Record: RHSA-2018:2424
CVSS 3.0: 7.6 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.cxf:cxf-core` Maven	3.2.0 to 3.2.0	3.2.1
`org.apache.cxf:cxf-core` Maven	3.1.0 to 3.1.13	3.1.14
`org.apache.cxf:cxf-core` Maven	before 3.0.16	3.0.16
`org.apache.cxf:cxf-core` Maven	3.2.0 up to 3.2.1	3.2.1
`org.apache.cxf:cxf-core` Maven	3.1.0 up to 3.1.14, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 8 moreShow less 3.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9	3.1.14
`org.apache.cxf:cxf-core` Maven	before 3.0.16, plus listed versions 3.0.03.0.0-milestone13.0.0-milestone23.0.13.0.10 Show 13 moreShow less 3.0.113.0.123.0.133.0.143.0.153.0.23.0.33.0.43.0.53.0.63.0.73.0.83.0.9	3.0.16
`eap7-activemq-artemis` Red Hat:jboss_enterprise_application_platform:7::el6 From an advisory covering 5 CVEs	before 0:1.5.5.013-1.redhat_1.1.ep7.el6	0:1.5.5.013-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-cli` Red Hat:jboss_enterprise_application_platform:7::el6 From an advisory covering 5 CVEs	before 0:1.5.5.013-1.redhat_1.1.ep7.el6	0:1.5.5.013-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-commons` Red Hat:jboss_enterprise_application_platform:7::el6 From an advisory covering 5 CVEs	before 0:1.5.5.013-1.redhat_1.1.ep7.el6	0:1.5.5.013-1.redhat_1.1.ep7.el6
`eap7-activemq-artemis-core-client` Red Hat:jboss_enterprise_application_platform:7::el6 From an advisory covering 5 CVEs	before 0:1.5.5.013-1.redhat_1.1.ep7.el6	0:1.5.5.013-1.redhat_1.1.ep7.el6

Show 212 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	tafamace/CVE-2017-12624	2018-11-19

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-12624 is a medium vulnerability (CVSS 5.5) in Apache Cxf, published November 14, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.70%, the 89th percentile. Fixed in org.apache.cxf:cxf-core 3.2.1.

References

Show 50 moreShow less