VulnerableCode Package Details - pkg:maven/org.apache.cxf/cxf-api@2.5-alpha0

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.apache.cxf/cxf-api@2.5-alpha0

Essentials
History (2)

purl	pkg:maven/org.apache.cxf/cxf-api@2.5-alpha0
Tags	Ghost

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	10.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-n8bd-use6-pbb2 Aliases: CVE-2012-3451 GHSA-55j7-f5wf-43m4	Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.	2.5.5 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.6.2 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-u5sk-1a1u-zuex Aliases: CVE-2013-2160 GHSA-254q-rp36-v2m8	Denial of Service Attacks on Apache CXF The streaming XML parser in this package remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of elements, attributes, nested constructs, and possibly other vectors.	2.5.10 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.6.7 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 2.7.4 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-n8bd-use6-pbb2
Aliases:
CVE-2012-3451
GHSA-55j7-f5wf-43m4

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.

2.5.5
Affected by 3 other vulnerabilities.

2.6.2
Affected by 3 other vulnerabilities.

VCID-u5sk-1a1u-zuex
Aliases:
CVE-2013-2160
GHSA-254q-rp36-v2m8

Denial of Service Attacks on Apache CXF The streaming XML parser in this package remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of elements, attributes, nested constructs, and possibly other vectors.

2.5.10
Affected by 2 other vulnerabilities.

2.6.7
Affected by 2 other vulnerabilities.

2.7.4
Affected by 2 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:46:49.991754+00:00	GitLab Importer	Affected by	VCID-u5sk-1a1u-zuex	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.cxf/cxf-api/CVE-2013-2160.yml	38.0.0
2026-04-01T12:46:47.392741+00:00	GitLab Importer	Affected by	VCID-n8bd-use6-pbb2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.cxf/cxf-api/CVE-2012-3451.yml	38.0.0