CVE-2024-41172: Apache CXF DOS Vulnerability

CVE-2024-41172 Overview

CVE-2024-41172 is a memory leak vulnerability in Apache CXF, an open source services framework used to build SOAP, REST, and XML-based web services in Java applications. The flaw resides in the CXF HTTP client conduit, which fails to release HTTPClient instances for garbage collection. Memory consumption grows over time until the affected Java Virtual Machine exhausts available heap space and the application terminates. The defect is tracked under CWE-401: Missing Release of Memory after Effective Lifetime and affects Apache CXF versions 3.6.0 through 3.6.3 and 4.0.0 through 4.0.4. Versions 3.5.x and earlier are not impacted.

Critical Impact

Remote, unauthenticated attackers can trigger sustained memory exhaustion in CXF-based services, leading to denial of service against the host application.

Affected Products

• Apache CXF 3.6.0 through 3.6.3
• Apache CXF 4.0.0 through 4.0.4
• Downstream products bundling vulnerable Apache CXF, including NetApp components referenced in advisory ntap-20240808-0008

Discovery Timeline

• 2024-07-18 - Vulnerability publicly disclosed via the oss-security mailing list
• 2024-07-19 - CVE-2024-41172 published to the National Vulnerability Database
• 2024-08-08 - NetApp publishes advisory ntap-20240808-0008 covering downstream impact
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-41172

Vulnerability Analysis

Apache CXF uses an HTTPConduit abstraction to manage outbound HTTP traffic from JAX-WS and JAX-RS clients. Internally, the conduit instantiates Apache HttpClient (or the JDK HTTP client) objects to perform request dispatch. In vulnerable releases, the conduit retains references to these client instances beyond their effective lifetime. The Java garbage collector cannot reclaim the associated heap objects, resulting in unbounded heap growth.

The issue is exploitable in any scenario where a long-running CXF service or client repeatedly opens HTTP conduits. Examples include API gateways, enterprise service buses, and microservices that issue outbound SOAP or REST calls. An attacker who can induce additional conduit creation accelerates exhaustion. Once heap space is depleted, the JVM throws OutOfMemoryError and the application becomes unresponsive.

Root Cause

The root cause is a retained reference inside the HTTP conduit implementation that prevents the garbage collector from releasing HTTPClient objects after their associated request completes. This is a classic [CWE-401] memory leak pattern in long-lived Java services.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker generates traffic patterns that cause the target application to repeatedly construct HTTP conduits, amplifying the leak. The vulnerability impacts only availability. Confidentiality and integrity are not affected. The current EPSS score is 1.187% (percentile 79.047), reflecting moderate predicted exploitation likelihood for an availability-only flaw.

No verified public proof-of-concept code is available. See the Apache CXF thread discussion for the project's technical write-up.

Detection Methods for CVE-2024-41172

Indicators of Compromise

• Steadily increasing JVM heap utilization in Apache CXF based services that does not return to baseline after garbage collection cycles.
• Recurring java.lang.OutOfMemoryError: Java heap space entries in application logs originating from threads handling CXF HTTP transport.
• Heap dumps showing large retained sets of org.apache.cxf.transport.http.HTTPConduit and associated HttpClient instances.

Detection Strategies

• Inventory Java applications for cxf-rt-transports-http artifacts at versions 3.6.0–3.6.3 or 4.0.0–4.0.4 using software composition analysis tools.
• Profile non-production instances under sustained load and compare heap retention of HTTPConduit objects before and after upgrading.
• Correlate process restarts, OOM-killer events, and container restarts with CXF stack traces in centralized logging.

Monitoring Recommendations

• Enable JVM metrics export (JMX, Micrometer, or OpenTelemetry) and alert on monotonic heap growth across deployment windows.
• Set container memory limits with restart policies, and alert when restart counts exceed baseline thresholds for CXF services.
• Track outbound HTTP conduit creation rates from CXF clients to detect anomalous bursts that accelerate the leak.

How to Mitigate CVE-2024-41172

Immediate Actions Required

• Upgrade Apache CXF to version 3.6.4, 4.0.5, or later, which contain the upstream fix.
• Identify all internal and third-party applications that bundle vulnerable CXF releases, including products covered by the NetApp advisory ntap-20240808-0008.
• Schedule rolling restarts of exposed CXF services until patching is complete to release leaked heap memory.

Patch Information

The Apache CXF project addressed the leak in releases 3.6.4 and 4.0.5. Maven and Gradle users should update the org.apache.cxf dependency coordinates accordingly and rebuild downstream artifacts. Refer to the Apache CXF advisory thread for the authoritative release notes.

Workarounds

• Where patching cannot be performed immediately, configure JVM heap limits and automatic restart policies so leaked memory is reclaimed before exhaustion occurs.
• Rate-limit untrusted clients that can trigger repeated outbound HTTP conduit creation in CXF services.
• Downgrade to Apache CXF 3.5.x only if functional compatibility allows, since 3.5.x and earlier are not impacted by this issue.

# Configuration example: Maven dependency update to patched Apache CXF
# pom.xml
# <dependency>
#   <groupId>org.apache.cxf</groupId>
#   <artifactId>cxf-rt-transports-http</artifactId>
#   <version>4.0.5</version>
# </dependency>

mvn versions:set-property -Dproperty=cxf.version -DnewVersion=4.0.5
mvn clean verify