CVE-2016-5004: The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attacke...

Security readout for executives and security teams

CVE-2016-5004 is a remote denial-of-service issue tied to compressed HTTP request handling in ws-xmlrpc 3.1.3 as used by Apache Archiva. A small-looking compressed request can expand into heavy server resource use. The available bundle does not provide a CVSS score, fixed version, or evidence of active exploitation. Exposure is most likely where Apache Archiva deployments include ws-xmlrpc 3.1.3 and accept compressed HTTP requests to the affected XML-RPC handling path. The provided data does not identify affected Archiva versions, CPEs, internet exposure prevalence, or downstream products. Address during normal vulnerability management unless Archiva is internet-facing or operationally critical. Raise priority if affected instances are exposed to untrusted users, because the impact is service disruption rather than data theft in the provided evidence. Mitigation focus: Inventory Apache Archiva instances and bundled ws-xmlrpc versions.; Check Apache Archiva and ws-xmlrpc vendor guidance for fixed versions or supported mitigations.; Restrict public access to Archiva management and XML-RPC interfaces where business permits..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.