CVE:CVE-2019-12406
CNNVD:CNNVD-201911-332
Apache CXF是美国阿帕奇（Apache）基金会的一个开源的Web服务框架。该框架支持多种Web服务标准、多种前端编程API等。
Apache CXF 3.3.4之前版本和3.2.11之前版本中存在资源管理错误漏洞，该漏洞源于程序没有限制消息中的附件数。攻击者可借助含有大量附件的消息利用该漏洞造成拒绝服务。
solution:Upgrade apache cxf to a higher version than 3.2.11,3.3.4,and avoid the version (,3.2.11),[3.3.0,3.3.4); Upgrade oracle commerce_guided_search to a higher version than 11.3.2,and avoid the version 11.3.2; Upgrade oracle flexcube_private_banking to a higher version than 12.0.0,12.1.0,and avoid the version 12.0.0,12.1.0; Upgrade oracle retail_order_broker to a higher version than 15.0,and avoid the version 15.0