Threats tagged 'ghsa-ghvc-7hp8-2g2v'

Apache CXF versions prior to 4.1.7, 4.2.2, and 3.6.12 allow an unlimited number of attachment headers during message deserialization. This lack of restriction can lead to uncontrolled resource consumption, potentially causing denial of service (DoS) conditions. The issue is addressed by imposing a default maximum of 500 attachments per message in the fixed versions.