vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2019-12406

MEDIUM
6.5
CVSS Score
Published: November 6, 2019 at 08:07 PM UTC
Updated: June 17, 2026 at 02:14 AM UTC
4 products affected across 2 vendorsCommerce Guided SearchCXFFlexcube Private Banking

Using Apache CXF by N/A?

Get instant alerts when new vulnerabilities affect Apache CXF - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 6%

Description

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

CXF· Apachemaven
95%
v < 3.2.11v < 3.3.43.3.0 ≤ v < 3.3.4
Affected range stops below 3.2.11, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.3.4, so it looks safe — our inference, not a vendor statement
Commerce Guided Search· Oracledrupal
95%
11.3.2
Flexcube Private Banking· Oracle
95%
12.0.012.1.0
Retail Order Broker· Oracle
95%
15.0

References (14)

x_refsource_CONFIRMVendor Advisory
Source: [email protected]
http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r92238967ba2783d3ab5a483f2e17f5fdaa8ace98990f69f9e8e15de0%40%3Cissues.cxf.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rabc395b38acb7f2465bfbf0bc16d6e1e95720c89bea87abe8808eeea%40%3Cissues.cxf.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rb2a6dab1f781f55326543c56dc29ea677759439ddfeba920c83037e6%40%3Cissues.cxf.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rca465c9d1e1969281338522b76701c85a07abd045c494261137236e0%40%3Cissues.cxf.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E

CVSS

6.5MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card