{"id":"CVE-2013-2160","aliases":["EUVD-2022-1906","GHSA-254q-rp36-v2m8","MGASA-2014-0001"],"status":"published","title":"Missing XML Validation in Apache CXF","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.32259,"percentile":0.98332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-112","CWE-399"],"published":"2013-08-19T23:00:00Z","modified":"2026-06-16T23:52:51Z","exploits":[{"source":"exploitdb","id":"EDB-26710","title":"Apache CXF \u003c 2.5.10/2.6.7/2.7.4 - Denial of Service","type":"dos","platform":"multiple","date":"2013-07-09","verified":true,"url":"https://www.exploit-db.com/exploits/26710"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","fixed_in":["2.5.10","2.6.7","2.7.4"],"sources":["ghsa","osv"]},{"ecosystem":"Mageia:3","package":"cxf","fixed_in":["2.6.9-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"jacorb","fixed_in":["2.3.1-4.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"wss4j","fixed_in":["1.6.10-1.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.10"}]}],"versions":["2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.7"}]}],"versions":["2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-frontend-jaxrs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.4"}]}],"versions":["2.7.0","2.7.1","2.7.2","2.7.3"]},{"source":"osv","ecosystem":"Mageia:3","package":"cxf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"jacorb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-4.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"wss4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.10-1.mga3"}]}]}],"products":[{"vendor":"apache","product":"cxf"}],"references":[{"url":"https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1437.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","web"]},{"url":"http://jira.codehaus.org/browse/WSTX-287","tags":["x_refsource_MISC","x_transferred","Patch","web"]},{"url":"http://jira.codehaus.org/browse/WSTX-285","tags":["x_refsource_MISC","x_transferred","Patch","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1028.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=929197","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2160","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-254q-rp36-v2m8"},{"url":"https://advisories.mageia.org/MGASA-2014-0001.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10986","tags":["report"]},{"url":"http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc?version=1\u0026modificationDate=1372324301037","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-August/113793.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-August/113792.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-August/113791.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2160","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","status":"published","published":"2013-08-19T23:00:00Z","modified":"2024-08-06T15:27:40.907Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2022-1906","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","status":"published","published":"2013-08-19T23:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-254q-rp36-v2m8","title":"Missing XML Validation in Apache CXF","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","status":"published","published":"2022-05-13T01:09:20Z","modified":"2023-01-27T05:02:13Z","cwes":["CWE-112"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2013-2160","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","status":"published","published":"2013-08-19T23:55:08.477Z","modified":"2026-06-16T23:52:51.597Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"GHSA-254q-rp36-v2m8","title":"Missing XML Validation in Apache CXF","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","status":"published","published":"2022-05-13T01:09:20Z","modified":"2024-12-05T05:42:24.331228Z","cwes":["CWE-112"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"MGASA-2014-0001","title":"Updated cxf, wss4j, and jacorb packages fix security vulnerability","description":"Multiple denial of service flaws were found in the way StAX parser\nimplementation of Apache CXF, an open-source web services framework,\nperformed processing of certain XML files. If a web service application\nutilized the services of the StAX parser, a remote attacker could provide\na specially-crafted XML file that, when processed by the application would\nlead to excessive system resources (CPU cycles, memory) consumption by\nthat application (CVE-2013-2160).\n","status":"published","published":"2014-01-06T00:49:54Z","modified":"2026-04-16T06:26:31.443207642Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}