{"id":"CVE-2024-32007","aliases":["CLSA-2026-1776040410","EUVD-2024-2281","GHSA-6pff-fmh2-4mmf"],"status":"published","title":"Apache CXF Denial of Service vulnerability in JOSE","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01314,"percentile":0.709,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400"],"published":"2024-07-19T08:50:31Z","modified":"2026-11-02T19:45:23Z","fixes":[{"ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","fixed_in":["4.0.5","3.6.4","3.5.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-databinding-aegis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-rs-service-description","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.cxf:cxf-rt-transports-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5"},{"fixed":"3.4.5-tuxcare.1"}]}],"versions":["3.4.5"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.5"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.6.4"}]}],"versions":["3.6.0","3.6.1","3.6.2","3.6.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.cxf:cxf-rt-rs-security-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.9"}]}],"versions":["3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.16","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.16","3.1.17","3.1.18","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.14","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9","3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9","3.4.0","3.4.1","3.4.10","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9","3.5.0","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8"]}],"products":[{"vendor":"apache","product":"cxf"},{"vendor":"apache software foundation","product":"apache cxf"}],"references":[{"url":"https://lists.apache.org/thread/stwrgsr1llb73nkl16klv9vjqgmmx633","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240808-0009/","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/18/3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32007","tags":["advisory"]},{"url":"https://github.com/apache/cxf/commit/20793d3fed2e73e2785a58ec5b47403306ae4a5c","tags":["web"]},{"url":"https://github.com/apache/cxf/commit/2d2baa3455db7439bf1ed4e00edfc5a7106edf7d","tags":["web"]},{"url":"https://github.com/apache/cxf/commit/d1d77c34c199c2c87ebcfe23e3c81dccfe2e2473","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6pff-fmh2-4mmf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32007.json","tags":["advisory"]},{"url":"https://github.com/apache/cxf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-32007","title":"Apache CXF Denial of Service vulnerability in JOSE","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","status":"published","published":"2024-07-19T08:50:31.832Z","modified":"2024-09-13T17:04:44.644Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400","CWE-20"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-2281","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","status":"published","published":"2024-07-19T08:50:31Z","modified":"2024-09-13T17:04:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:55.467153Z"}],"ghsa":[{"id":"GHSA-6pff-fmh2-4mmf","title":"Apache CXF Denial of Service vulnerability in JOSE","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","status":"published","published":"2024-07-19T09:32:06Z","modified":"2024-08-08T05:09:01Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2024-32007","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","status":"published","published":"2024-07-19T09:15:04.713Z","modified":"2026-06-17T07:29:06.897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"CVE-2024-32007","title":"Apache CXF Denial of Service vulnerability in JOSE","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","status":"published","published":"2024-07-19T08:50:31.832Z","modified":"2026-10-28T02:30:58.18144329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-400"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-6pff-fmh2-4mmf","title":"Apache CXF Denial of Service vulnerability in JOSE","description":"An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. \n","status":"published","published":"2024-07-19T09:32:06Z","modified":"2024-07-19T19:12:15.986303Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"CLSA-2026-1776040410","title":"TuxCare security update for org.apache.cxf (6 CVEs)","description":"TuxCare rebuilt 5 org.apache.cxf packages to address 6 CVEs. Fixed in 3.4.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-11-02T19:45:23.954889497Z","updated_at":"2026-11-02T20:30:40.499236Z"}]}}