Apache Axis2/Java SSRF via WSDL/XSD schema import resolution
Apache Axis2/Java before 2.0.2 allows SSRF when building service descriptions from WSDL through unrestricted fetching of absolute URLs in wsdl:import and xsd:import/include locations.
55
CVE-2026-120832
SSRF in Apache Axis2/Java via WSDL/XSD imports
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Axis2/Java fetches absolute URLs in WSDL and XSD imports without restrictions during service description building. An attacker controlling a WSDL or schema can make the JVM request arbitrary hosts. Affects Apache Axis2/Java through 2.0.1.
What to do: Upgrade to Apache Axis2/Java 2.0.2.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis2/Java | through 2.0.1 | 2.0.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and xsd:include schemaLocations with no scheme or host restriction; the AAR and WAR deployment resolvers also passed absolute schema locations on to the network. An attacker who controls a WSDL or schema processed by an Axis2 application could therefore make the JVM send requests to arbitrary internal or external hosts. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Weakness
- CWE-918