5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48795

CVE-2025-48795: Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged

Apache CXF stores large stream based messages as temporary files on the local filesystem. A bug was introduced which means that the entire temporary file is read into memory and then logged. An attacker might be able to exploit this to cause a denial of service attack by causing an out of memory exception. In addition, it is possible to configure CXF to encrypt temporary files to prevent sensitive credentials from being cached unencrypted on the local filesystem, however this bug means that the cached files are written out to logs unencrypted.

Users are recommended to upgrade to versions 3.5.11, 3.6.6, 4.0.7 or 4.1.1, which fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48795

CVE-2025-48795:

5.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.apache.cxf:cxf-core	maven	< 3.5.11	3.5.11
org.apache.cxf:cxf-core	maven	>= 3.6.0, < 3.6.6	3.6.6
org.apache.cxf:cxf-core	maven	>= 3.6.7, < 4.0.7	4.0.7
org.apache.cxf:cxf-core	maven	>= 4.1.0, < 4.1.1	4.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists due to an unsafe logging practice within the Apache CXF framework. When the DelayedCachedOutputStreamCleaner thread detects a leaked stream (an unclosed CachedOutputStream), it attempts to log a warning message. The vulnerable code concatenates the CachedOutputStream object directly into the log string: LOG.warning("Unclosed (leaked?) stream detected: " + next.closeable);. This action triggers the toString() method on the CachedOutputStream object.

The CachedOutputStream.toString() method is implemented to provide a string representation of the stream's content for debugging purposes. It does this by reading the entire stream—which for large payloads is spooled to a temporary file on disk—into memory. This behavior has two critical security implications:

Denial of Service (DoS): An attacker can send a large payload, which gets written to a temporary file. By intentionally leaking this stream, they trigger the cleaner thread. The subsequent call to toString() attempts to load the entire large file into memory, which can exhaust the heap space and cause an OutOfMemoryError, crashing the application.
Information Disclosure: CXF allows for the encryption of these temporary files to protect sensitive data at rest. However, the toString() method reads the decrypted content of the stream. This means that if an encrypted temporary file is logged via this vulnerability, its sensitive contents will be written to the logs in plaintext.

The fix applied in the patch replaces the logging of the object itself with its hash code (next.closeable.hashCode()). This avoids calling the expensive and unsafe toString() method, thus mitigating both the DoS and the information disclosure risks. The key functions in the execution of this vulnerability are DelayedCachedOutputStreamCleaner.clean(), which initiates the logging, and CachedOutputStream.toString(), which performs the unsafe operation of reading the entire file into memory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.