$ cve CVE-2010-2076 JSON

CVE-2010-2076

9.8

CRITICAL · CVSS 3.1 · EPSS 9.8% (pctl 95)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	9.79% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-829
On CISA KEV	no
Public exploit	none known
Published	2010-08-19
Last modified	2026-06-16

Affected (1)

Vendor	Product
apache	cxf

References

→ the Explorer · watch your stack · NVD