CVE-2016-5004

CVE-2016-5004 describes a denial-of-service vulnerability in Apache Archiva, specifically within its ws-xmlrpc 3.1.3 component. Attackers can exploit this by sending a crafted HTTP request with a Content-Encoding header referencing a large, compressed file of zeroes, leading to excessive resource consumption during decompression. Rated Medium severity (CVSS 6.5), this vulnerability requires user interaction (UI:R) but can be exploited remotely (AV:N) with low complexity (AC:L), resulting in high availability impact (A:H). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.