-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.xmlrpc:xmlrpc-common | maven | <= 3.1.3 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of compressed content in XML-RPC requests. The XML-RPC servlet's doPost method processes the Content-Encoding header and decompresses the input stream without implementing safeguards against excessive resource consumption. This matches the CWE-400 pattern where decompression of attacker-controlled data (zero-filled payloads with high compression ratios) leads to uncontrolled memory/CPU usage. The identification aligns with the vulnerability's description of 'decompressing a large file containing zeroes' via Content-Encoding handling in ws-xmlrpc.
KEV Misses 88% of Exploited CVEs- Get the report