Apache CXF multipart header-limit bypass enables unauthenticated DoS
Apache CXF did not fully enforce its multipart/MTOM attachment header limits. The size cap (default 300 characters) was applied only to each physical line, not to values built from folded continuation lines or from repeated headers, and the count cap (default 500) counted distinct header names rather than total header lines. A remote, unauthenticated attacker can send a multipart request with very large folded or repeated part headers so the server allocates memory without bound and becomes unavailable. Anyone running an unfixed CXF service that accepts multipart/MTOM attachments is affected. There is no known public proof of concept and no report of exploitation in the wild.
What to do: Upgrade Apache CXF to 4.2.4, 4.1.9, or 3.6.13. Until then, restrict unauthenticated multipart/MTOM endpoints and enforce request and header size limits at the reverse proxy or gateway, and watch those services for unexpected memory growth.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache CXF | Releases earlier than the fixed versions 3.6.13, 4.1.9, and 4.2.4 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Apache CXF attachment header limits can be bypassed, allowing denial of service via memory exhaustion.
Today 846 readers · 1.1K views · 848 reads · all time 159K views