WhatBrokeToday
FAQ
Today's Trends
highWorkaround availableApachevthrough 2.0.1

Apache Axis2/Java Unbounded Request Body Memory and Disk Exhaustion Vulnerabilities

  1. Investigating(done)
  2. Trending(skipped)
  3. Workaround available(current)
  4. Resolved(upcoming)

Executive summary

Apache Axis2/Java versions through 2.0.1 contain resource limitation vulnerabilities in JSON, multipart/form-data, and application/x-www-form-urlencoded message builders. Unauthenticated attackers can send large requests to exhaust server memory or disk space.

Workaround available

Upgrade to Version 2.0.2 to use configurable limits.

Reported inCVEevidence [1]
Official fix
Technical root cause

Message builders buffered entire request bodies from transport streams with no size limits, failing to apply servlet container limits and leaving temporary files undeleted.

Evidence

2 reports · 2 CVEShow
  1. [1]
    CVE First report
    Apache Axis2/Java.: CVE-2026-120367 (High)(opens security advisory in a new tab)

    High severity. Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to…

    by Tenable 0upvotes 0comments

  2. [2]
    CVE
    Apache Axis2/Java.: CVE-2026-123770 (High)(opens security advisory in a new tab)

    High severity. Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes…

    by Tenable 0upvotes 0comments95% match

Timeline

  1. First report on security advisory

    Apache Axis2/Java.: CVE-2026-120367 (High)

    Source
  2. Workaround discovered

    Workaround reported: Upgrade to Version 2.0.2 and configure the jsonMaxRequestSize parameter.

    Source
  3. Status changed

    Status changed: new → workaround_available (workaround reported in source signals).