CVE-2016-5004: Apache Ws-Xmlrpc

Medium severity, CVSS 6.5. EPSS: 7.5% chance of exploitation in the next 30 days.

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

Affected products

• Apache Ws-Xmlrpc: version 3.1.3 only

Published 2017-06-06. Last modified 2026-06-17.