Apache Axis2/Java before 2.0.2 has unbounded multipart request bodies (CVE-2026-123770)
Original title: CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
The multipart/form-data and application/x-www-form-urlencoded builders have no size limit
Apache Axis2/Java has an allocation of resources without limits or throttling vulnerability. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply.
- Affected versions: Apache Axis2/Java before 2.0.2
- Severity: low
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123770 | Resource exhaustion in Apache Axis2/Java multipart bodies | — | — |
From the original article
Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2. 0. 2 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.