Apache Axis2/Java JSON buffer vulnerability (CVE-2026-120367)
Original title: CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering
Apache Axis2/Java JSON builders buffered full request bodies without limits, enabling unauthenticated memory exhaustion, fixed in 2.0.2.
The JSON message builders in Apache Axis2/Java including Gson, Moshi and HTTP/2 variants buffered entire request bodies with no size limit. An unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 introduces configurable bounds.
- JSON builders in Apache Axis2/Java buffered full request body
- No size limit allows memory exhaustion by unauthenticated callers
- Fixed in version 2.0.2 with request body limits
- Affects Apache Axis2/Java before 2.0.2
Impact: unauthenticated memory exhaustion via large JSON requests
- 1.Upgrade to Apache Axis2/Java 2.0.2 or later
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120367 | Memory Exhaustion in Apache Axis2/Java JSON Request Buffering | 7.5 | — |
From the original article
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2. 0. 2 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.