-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from HTTPClient instances not being garbage collected due to retained references in the HTTPConduit. The HTTPConduit class manages client configurations and connections. The finalizeConfig() method is a likely candidate because it initializes HTTPClient instances and configures TLS settings/connection managers. If these configurations are not properly released (e.g., static references in TLSContextConfig or unreleased connection pools), they would prevent HTTPClient instances from being GC'd. The confidence is medium due to indirect evidence from the vulnerability description and typical patterns in HTTP client lifecycle management, though exact code changes are unavailable.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cxf:cxf-rt-transports-http | maven | >= 4.0.0, < 4.0.5 | 4.0.5 |
| org.apache.cxf:cxf-rt-transports-http | maven | >= 3.6.0, < 3.6.4 | 3.6.4 |
KEV Misses 88% of Exploited CVEs- Get the report