[CXF-7507] Put a configurable limit on the attachment header sizes

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.1.11
• Fix Version/s: 3.0.16, 3.1.14, 3.2.1
• Component/s: Core
• Estimated Complexity: Novice
• Assignee: Colm O hEigeartaigh
• Reporter: kevin.wang
• Created: 15/Sep/17 15:08
• Updated: 28/Nov/17 10:40
• Resolved: 03/Oct/17 15:03

Description

There is one possible DOS vulnerability in the code ContentDisposition constructor.
In the codes , it will use the pattern to parse MIME content-disposition.
if the content-disposition content has more than 50000 chars,one radical example , 1 million , CPU usage of any web service
would be used up and reach over more than 98%.

please consider solve this issue asap.