CVE-2021-30468: Apache Cxf

High severity, CVSS 7.5. EPSS: 7% chance of exploitation in the next 30 days.

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.

Affected products

• Apache Cxf: before 3.3.11 (fixed in 3.3.11); from 3.4.0, before 3.4.4 (fixed in 3.4.4)
• Apache Tomee: version 8.0.6 only
• Oracle Business Intelligence: version 5.5.0.0.0 only; version 5.9.0.0.0 only; version 12.2.1.3.0 only; version 12.2.1.4.0 only
• Oracle Communications Element Manager: version 8.2.2 only
• Oracle Communications Messaging Server: version 8.1 only

Published 2021-06-16. Last modified 2026-06-17.