Every CVE Search/ Get API key

CVE-2024-41172

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

7.5 HighFix available

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.20%Up 1.2 points since Jul 20, 2024
90%50%10%1%

What each source reports

NVD Score used 7.5

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Record
CVE-2024-41172
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
CVE List 5.3

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Record
CVE-2024-41172
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
EUVDEUVD-2024-2246 5.3

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Record
EUVD-2024-2246
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-4mgg-fqfq-64hg 6.3

Apache CXF allows unrestricted memory consumption in CXF HTTP clients

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Record
GHSA-4mgg-fqfq-64hg
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
OSV 5.3

Apache CXF: Unrestricted memory consumption in CXF HTTP clients

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Record
CVE-2024-41172
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
OSVGHSA-4mgg-fqfq-64hg 6.3

Apache CXF allows unrestricted memory consumption in CXF HTTP clients

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from being garbage collected and it is possible that memory consumption will continue to increase, eventually causing the application to run out of memory

Record
GHSA-4mgg-fqfq-64hg
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-401
Updated
2026-11-02
OSVRHSA-2024:8823 7.7

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update

Record
RHSA-2024:8823
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Updated
2026-11-02
OSVRHSA-2024:8824 7.7

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.4 Security update

Record
RHSA-2024:8824
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.cxf:cxf-rt-transports-http
Maven
 4.0.0 up to 4.0.5
4.0.5
org.apache.cxf:cxf-rt-transports-http
Maven
 3.6.0 up to 3.6.4
3.6.4
org.apache.cxf:cxf-rt-transports-http
Maven
 4.0.0 up to 4.0.5, plus listed versions
4.0.14.0.24.0.34.0.4
4.0.5
org.apache.cxf:cxf-rt-transports-http
Maven
 3.6.0 up to 3.6.4, plus listed versions
3.6.13.6.23.6.3
3.6.4
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
Show 154 moreShow less
Affected packages
PackageAffectedFixed
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-native
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 1:2.0.0-2.redhat_00005.1.el8eap
1:2.0.0-2.redhat_00005.1.el8eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el8eap
0:2.33.0-1.redhat_00015.1.el8eap
eap8-aesh-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.8.0-2.redhat_00001.1.el8eap
0:1.8.0-2.redhat_00001.1.el8eap
eap8-aesh-readline
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.2.0-2.redhat_00001.1.el8eap
0:2.2.0-2.redhat_00001.1.el8eap
eap8-apache-commons-codec
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.16.1-2.redhat_00007.1.el8eap
0:1.16.1-2.redhat_00007.1.el8eap
eap8-apache-commons-collections
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.2.2-28.redhat_2.1.el8eap
0:3.2.2-28.redhat_2.1.el8eap
eap8-apache-commons-io
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.15.1-1.redhat_00001.1.el8eap
0:2.15.1-1.redhat_00001.1.el8eap
eap8-apache-commons-lang
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.14.0-2.redhat_00006.1.el8eap
0:3.14.0-2.redhat_00006.1.el8eap
eap8-apache-cxf
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el8eap
0:4.0.5-1.redhat_00001.1.el8eap
eap8-apache-cxf-rt
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el8eap
0:4.0.5-1.redhat_00001.1.el8eap
eap8-apache-cxf-services
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el8eap
0:4.0.5-1.redhat_00001.1.el8eap
eap8-apache-cxf-tools
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el8eap
0:4.0.5-1.redhat_00001.1.el8eap
eap8-artemis-native
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 1:2.0.0-2.redhat_00005.1.el8eap
1:2.0.0-2.redhat_00005.1.el8eap
eap8-artemis-native-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 1:2.0.0-2.redhat_00005.1.el8eap
1:2.0.0-2.redhat_00005.1.el8eap
eap8-artemis-wildfly-integration
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.0.1-1.redhat_00002.1.el8eap
0:2.0.1-1.redhat_00002.1.el8eap
eap8-asyncutil
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:0.1.0-2.redhat_00010.1.el8eap
0:0.1.0-2.redhat_00010.1.el8eap
eap8-aws-java-sdk
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el8eap
0:1.12.284-2.redhat_00002.1.el8eap
eap8-aws-java-sdk-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el8eap
0:1.12.284-2.redhat_00002.1.el8eap
eap8-aws-java-sdk-kms
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el8eap
0:1.12.284-2.redhat_00002.1.el8eap
eap8-aws-java-sdk-s3
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el8eap
0:1.12.284-2.redhat_00002.1.el8eap
eap8-cryptacular
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.2.5-2.redhat_00001.1.el8eap
0:1.2.5-2.redhat_00001.1.el8eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:800.4.0-1.GA_redhat_00001.1.el8eap
0:800.4.0-1.GA_redhat_00001.1.el8eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:800.4.0-1.GA_redhat_00001.1.el8eap
0:800.4.0-1.GA_redhat_00001.1.el8eap
eap8-fastinfoset
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.1.0-4.redhat_00001.1.el8eap
0:2.1.0-4.redhat_00001.1.el8eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.2.31-1.Final_redhat_00002.1.el8eap
0:6.2.31-1.Final_redhat_00002.1.el8eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.2.31-1.Final_redhat_00002.1.el8eap
0:6.2.31-1.Final_redhat_00002.1.el8eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.2.31-1.Final_redhat_00002.1.el8eap
0:6.2.31-1.Final_redhat_00002.1.el8eap
eap8-hibernate-validator
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.1-3.Final_redhat_00001.1.el8eap
0:8.0.1-3.Final_redhat_00001.1.el8eap
eap8-hibernate-validator-cdi
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.1-3.Final_redhat_00001.1.el8eap
0:8.0.1-3.Final_redhat_00001.1.el8eap
eap8-hppc
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:0.8.1-2.redhat_00001.1.el8eap
0:0.8.1-2.redhat_00001.1.el8eap
eap8-insights-java-client
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.1.3-1.redhat_00001.1.el8eap
0:1.1.3-1.redhat_00001.1.el8eap
eap8-jakarta-servlet-jsp-jstl
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.0.1-1.redhat_00001.1.el8eap
0:3.0.1-1.redhat_00001.1.el8eap
eap8-jakarta-servlet-jsp-jstl-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.0.1-1.redhat_00001.1.el8eap
0:3.0.1-1.redhat_00001.1.el8eap
eap8-jboss-cert-helper
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.1.3-1.redhat_00001.1.el8eap
0:1.1.3-1.redhat_00001.1.el8eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.5.3-1.Final_redhat_00001.1.el8eap
0:3.5.3-1.Final_redhat_00001.1.el8eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:4.0.2-1.redhat_00001.1.el8eap
0:4.0.2-1.redhat_00001.1.el8eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:4.0.2-1.redhat_00001.1.el8eap
0:4.0.2-1.redhat_00001.1.el8eap
eap8-jgroups
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:5.3.10-1.Final_redhat_00001.1.el8eap
0:5.3.10-1.Final_redhat_00001.1.el8eap
eap8-jmespath-java
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el8eap
0:1.12.284-2.redhat_00002.1.el8eap
eap8-log4j
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.22.1-1.redhat_00002.1.el8eap
0:2.22.1-1.redhat_00002.1.el8eap
eap8-narayana
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-jbosstxbridge
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-jbossxts
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-jts-idlj
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-jts-integration
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-bridge
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-integration
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-narayana-restat-util
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el8eap
0:6.0.3-1.Final_redhat_00001.1.el8eap
eap8-nimbus-jose-jwt
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:9.37.3-1.redhat_00001.1.el8eap
0:9.37.3-1.redhat_00001.1.el8eap
eap8-objectweb-asm
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:9.6.0-1.redhat_00002.1.el8eap
0:9.6.0-1.redhat_00002.1.el8eap
eap8-objectweb-asm-util
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:9.6.0-1.redhat_00002.1.el8eap
0:9.6.0-1.redhat_00002.1.el8eap
eap8-pem-keystore
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.3.0-1.redhat_00001.1.el8eap
0:2.3.0-1.redhat_00001.1.el8eap
eap8-resteasy-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.0.1-3.Final_redhat_00001.1.el8eap
0:2.0.1-3.Final_redhat_00001.1.el8eap
eap8-resteasy-spring
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.0.1-2.Final_redhat_00001.1.el8eap
0:3.0.1-2.Final_redhat_00001.1.el8eap
eap8-resteasy-tracing-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.0.1-3.Final_redhat_00001.1.el8eap
0:2.0.1-3.Final_redhat_00001.1.el8eap
eap8-saaj-impl
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:3.0.4-1.redhat_00001.1.el8eap
0:3.0.4-1.redhat_00001.1.el8eap
eap8-shibboleth-java-support
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.0-6.redhat_00001.1.el8eap
0:8.0.0-6.redhat_00001.1.el8eap
eap8-slf4j
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.0.16-1.redhat_00001.1.el8eap
0:2.0.16-1.redhat_00001.1.el8eap
eap8-slf4j-api
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.0.16-1.redhat_00001.1.el8eap
0:2.0.16-1.redhat_00001.1.el8eap
eap8-snakeyaml
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:2.2.0-1.redhat_00001.1.el8eap
0:2.2.0-1.redhat_00001.1.el8eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el8eap
0:8.0.4-2.GA_redhat_00005.1.el8eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el8eap
0:8.0.4-2.GA_redhat_00005.1.el8eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el8eap
0:8.0.4-2.GA_redhat_00005.1.el8eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el8eap
0:8.0.4-2.GA_redhat_00005.1.el8eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el8
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el8eap
0:8.0.4-2.GA_redhat_00005.1.el8eap
eap8-activemq-artemis
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-cli
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-commons
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-core-client
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-dto
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-hornetq-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-hqclient-protocol
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-jakarta-client
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-jakarta-ra
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-jakarta-server
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-jakarta-service-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-jdbc-store
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-journal
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-native
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 1:2.0.0-2.redhat_00005.1.el9eap
1:2.0.0-2.redhat_00005.1.el9eap
eap8-activemq-artemis-selector
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-activemq-artemis-server
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.33.0-1.redhat_00015.1.el9eap
0:2.33.0-1.redhat_00015.1.el9eap
eap8-aesh-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.8.0-2.redhat_00001.1.el9eap
0:1.8.0-2.redhat_00001.1.el9eap
eap8-aesh-readline
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.2.0-2.redhat_00001.1.el9eap
0:2.2.0-2.redhat_00001.1.el9eap
eap8-apache-commons-codec
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.16.1-2.redhat_00007.1.el9eap
0:1.16.1-2.redhat_00007.1.el9eap
eap8-apache-commons-collections
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.2.2-28.redhat_2.1.el9eap
0:3.2.2-28.redhat_2.1.el9eap
eap8-apache-commons-io
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.15.1-1.redhat_00001.1.el9eap
0:2.15.1-1.redhat_00001.1.el9eap
eap8-apache-commons-lang
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.14.0-2.redhat_00006.1.el9eap
0:3.14.0-2.redhat_00006.1.el9eap
eap8-apache-cxf
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el9eap
0:4.0.5-1.redhat_00001.1.el9eap
eap8-apache-cxf-rt
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el9eap
0:4.0.5-1.redhat_00001.1.el9eap
eap8-apache-cxf-services
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el9eap
0:4.0.5-1.redhat_00001.1.el9eap
eap8-apache-cxf-tools
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:4.0.5-1.redhat_00001.1.el9eap
0:4.0.5-1.redhat_00001.1.el9eap
eap8-artemis-native
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 1:2.0.0-2.redhat_00005.1.el9eap
1:2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-native-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 1:2.0.0-2.redhat_00005.1.el9eap
1:2.0.0-2.redhat_00005.1.el9eap
eap8-artemis-wildfly-integration
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.0.1-1.redhat_00002.1.el9eap
0:2.0.1-1.redhat_00002.1.el9eap
eap8-asyncutil
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:0.1.0-2.redhat_00010.1.el9eap
0:0.1.0-2.redhat_00010.1.el9eap
eap8-aws-java-sdk
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el9eap
0:1.12.284-2.redhat_00002.1.el9eap
eap8-aws-java-sdk-core
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el9eap
0:1.12.284-2.redhat_00002.1.el9eap
eap8-aws-java-sdk-kms
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el9eap
0:1.12.284-2.redhat_00002.1.el9eap
eap8-aws-java-sdk-s3
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el9eap
0:1.12.284-2.redhat_00002.1.el9eap
eap8-cryptacular
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.2.5-2.redhat_00001.1.el9eap
0:1.2.5-2.redhat_00001.1.el9eap
eap8-eap-product-conf-parent
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:800.4.0-1.GA_redhat_00001.1.el9eap
0:800.4.0-1.GA_redhat_00001.1.el9eap
eap8-eap-product-conf-wildfly-ee-feature-pack
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:800.4.0-1.GA_redhat_00001.1.el9eap
0:800.4.0-1.GA_redhat_00001.1.el9eap
eap8-fastinfoset
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.1.0-4.redhat_00001.1.el9eap
0:2.1.0-4.redhat_00001.1.el9eap
eap8-hibernate
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.2.31-1.Final_redhat_00002.1.el9eap
0:6.2.31-1.Final_redhat_00002.1.el9eap
eap8-hibernate-core
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.2.31-1.Final_redhat_00002.1.el9eap
0:6.2.31-1.Final_redhat_00002.1.el9eap
eap8-hibernate-envers
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.2.31-1.Final_redhat_00002.1.el9eap
0:6.2.31-1.Final_redhat_00002.1.el9eap
eap8-hibernate-validator
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.1-3.Final_redhat_00001.1.el9eap
0:8.0.1-3.Final_redhat_00001.1.el9eap
eap8-hibernate-validator-cdi
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.1-3.Final_redhat_00001.1.el9eap
0:8.0.1-3.Final_redhat_00001.1.el9eap
eap8-hppc
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:0.8.1-2.redhat_00001.1.el9eap
0:0.8.1-2.redhat_00001.1.el9eap
eap8-insights-java-client
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.1.3-1.redhat_00001.1.el9eap
0:1.1.3-1.redhat_00001.1.el9eap
eap8-jakarta-servlet-jsp-jstl
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.0.1-1.redhat_00001.1.el9eap
0:3.0.1-1.redhat_00001.1.el9eap
eap8-jakarta-servlet-jsp-jstl-api
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.0.1-1.redhat_00001.1.el9eap
0:3.0.1-1.redhat_00001.1.el9eap
eap8-jboss-cert-helper
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.1.3-1.redhat_00001.1.el9eap
0:1.1.3-1.redhat_00001.1.el9eap
eap8-jboss-logging
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.5.3-1.Final_redhat_00001.1.el9eap
0:3.5.3-1.Final_redhat_00001.1.el9eap
eap8-jctools
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:4.0.2-1.redhat_00001.1.el9eap
0:4.0.2-1.redhat_00001.1.el9eap
eap8-jctools-core
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:4.0.2-1.redhat_00001.1.el9eap
0:4.0.2-1.redhat_00001.1.el9eap
eap8-jgroups
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:5.3.10-1.Final_redhat_00001.1.el9eap
0:5.3.10-1.Final_redhat_00001.1.el9eap
eap8-jmespath-java
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:1.12.284-2.redhat_00002.1.el9eap
0:1.12.284-2.redhat_00002.1.el9eap
eap8-log4j
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.22.1-1.redhat_00002.1.el9eap
0:2.22.1-1.redhat_00002.1.el9eap
eap8-narayana
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-jbosstxbridge
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-jbossxts
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-jts-idlj
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-jts-integration
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-restat-api
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-restat-bridge
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-restat-integration
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-narayana-restat-util
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:6.0.3-1.Final_redhat_00001.1.el9eap
0:6.0.3-1.Final_redhat_00001.1.el9eap
eap8-nimbus-jose-jwt
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:9.37.3-1.redhat_00001.1.el9eap
0:9.37.3-1.redhat_00001.1.el9eap
eap8-objectweb-asm
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:9.6.0-1.redhat_00002.1.el9eap
0:9.6.0-1.redhat_00002.1.el9eap
eap8-objectweb-asm-util
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:9.6.0-1.redhat_00002.1.el9eap
0:9.6.0-1.redhat_00002.1.el9eap
eap8-pem-keystore
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.3.0-1.redhat_00001.1.el9eap
0:2.3.0-1.redhat_00001.1.el9eap
eap8-resteasy-extensions
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.0.1-3.Final_redhat_00001.1.el9eap
0:2.0.1-3.Final_redhat_00001.1.el9eap
eap8-resteasy-spring
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.0.1-2.Final_redhat_00001.1.el9eap
0:3.0.1-2.Final_redhat_00001.1.el9eap
eap8-resteasy-tracing-api
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.0.1-3.Final_redhat_00001.1.el9eap
0:2.0.1-3.Final_redhat_00001.1.el9eap
eap8-saaj-impl
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:3.0.4-1.redhat_00001.1.el9eap
0:3.0.4-1.redhat_00001.1.el9eap
eap8-shibboleth-java-support
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.0-6.redhat_00001.1.el9eap
0:8.0.0-6.redhat_00001.1.el9eap
eap8-slf4j
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.0.16-1.redhat_00001.1.el9eap
0:2.0.16-1.redhat_00001.1.el9eap
eap8-slf4j-api
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.0.16-1.redhat_00001.1.el9eap
0:2.0.16-1.redhat_00001.1.el9eap
eap8-snakeyaml
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:2.2.0-1.redhat_00001.1.el9eap
0:2.2.0-1.redhat_00001.1.el9eap
eap8-wildfly
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el9eap
0:8.0.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-java-jdk11
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el9eap
0:8.0.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-java-jdk17
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el9eap
0:8.0.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-java-jdk21
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el9eap
0:8.0.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-modules
Red Hat:jboss_enterprise_application_platform:8.0::el9
From an advisory covering 7 CVEs
 before 0:8.0.4-2.GA_redhat_00005.1.el9eap
0:8.0.4-2.GA_redhat_00005.1.el9eap

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-41172 is a high vulnerability (CVSS 7.5) in Apache Cxf, published July 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in org.apache.cxf:cxf-rt-transports-http 4.0.5.

References

Show 59 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open