Apache Axis2/Java before 2.0.2 has unbounded multipart request bodies (CVE-2026-123770)
The multipart/form-data and application/x-www-form-urlencoded builders have no size limit
30
CVE-2026-123770
Resource exhaustion in Apache Axis2/Java multipart bodies
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Axis2/Java's multipart/form-data and application/x-www-form-urlencoded builders read request bodies directly with no size limit or throttling. Unauthenticated attackers trigger this via crafted HTTP requests. They exhaust memory or disk space. Affects Apache Axis2/Java through 2.0.1.
What to do: Upgrade to Apache Axis2/Java 2.0.2 to fix unbounded request bodies.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Axis2/Java | through 2.0.1 | 2.0.2 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
- Weakness
- CWE-770