GCVE - cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:cxf:2.5.9:*:*:*:*:*:*:*

part: a version: 2.5.9 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Cxf (`50f1d7f0-1ad2-57a6-bb7b-0f9ea8944dab`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/cxf`	purl2cpe	2026-06-01 10:14:23.700665
`pkg:github/apache/cxf`	purl2cpe	2026-06-01 10:14:23.700667
`pkg:maven/org.apache.cxf/cxf`	purl2cpe	2026-06-01 10:14:23.700668
`pkg:rpm/fedora/cxf`	purl2cpe	2026-06-01 10:14:23.700669

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0110`	vulnerable	2026-06-08 05:05:11.540385	Details available Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message. Published: 2014-05-08T14:00:00.000Z Updated: 2024-08-06T09:05:38.936Z Open on db.gcve.eu Reference links http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378628&api=v2 http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html http://www.securitytracker.com/id/1030202 http://rhn.redhat.com/errata/RHSA-2014-1351.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0109`	vulnerable	2026-06-08 05:05:11.537406	Details available Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error. Published: 2014-05-08T14:00:00.000Z Updated: 2024-08-06T09:05:38.268Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html https://cxf.apache.org/security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370740&api=v2 http://www.securitytracker.com/id/1030201 http://rhn.redhat.com/errata/RHSA-2014-1351.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2160`	vulnerable	2026-06-08 05:03:58.670990	Details available The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors. Published: 2013-08-19T23:00:00.000Z Updated: 2024-08-06T15:27:40.907Z Open on db.gcve.eu Reference links https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc http://rhn.redhat.com/errata/RHSA-2013-1437.html http://jira.codehaus.org/browse/WSTX-287 http://jira.codehaus.org/browse/WSTX-285 http://rhn.redhat.com/errata/RHSA-2013-1028.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5575`	vulnerable	2026-06-08 05:02:57.374864	Details available Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack." Published: 2013-08-19T23:00:00.000Z Updated: 2024-08-06T21:14:16.301Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2013-0943.html https://bugzilla.redhat.com/show_bug.cgi?id=880443 http://rhn.redhat.com/errata/RHSA-2013-0839.html http://rhn.redhat.com/errata/RHSA-2013-0875.html http://www.securityfocus.com/bid/60043	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.