Apache Axis2/Java 2.0.2 fixes seven flaws including XXE and SSRF
First merged summary.
Apache Axis2/Java 2.0.2 fixes seven vulnerabilities, including XXE, SSRF, XSS, and unbounded request buffering, in earlier releases.
On November 6, 2026, oss-security posted seven Apache Axis2/Java advisories, all fixed in 2.0.2. Releases before 2.0.2 allow XXE when a client builds an AxisService from a WSDL URL, and SSRF through non-anonymous WS-Addressing ReplyTo or FaultTo addresses and unrestricted WSDL or XSD import fetches. JSON, multipart, and form-urlencoded builders read request bodies without size limits; 2.0.2 adds configurable JSON bounds. Swagger UI XSS affects 2.0.1 before 2.0.2. The exposeServiceMetadata flag did not cover every metadata route.
- Fixed in Apache Axis2/Java 2.0.2; most issues affect versions before 2.0.2.
- CVE-2026-120761: XXE when wsdl4j parses imported WSDL and XSD documents.
- CVE-2026-123753 and CVE-2026-120832: SSRF via addressing endpoints and schema imports.
- CVE-2026-120367 and CVE-2026-123770: unbounded JSON, multipart, and form bodies.
- CVE-2026-123766: moderate XSS in OpenAPI Swagger UI on 2.0.1 before 2.0.2.
- CVE-2026-123779: exposeServiceMetadata not applied to all metadata routes.
Timeline
dated events in the reporting · oldest first- Nov 6, 2026oss-security posts seven Axis2/Java advisories fixed in 2.0.2 · oss-security
What each outlet adds
beyond the shared facts- oss-securityLists all seven CVEs, affected versions, and stated severities
- CVEs
- CVE-2026-120832CVE-2026-123779CVE-2026-123753CVE-2026-120367CVE-2026-123766CVE-2026-120761CVE-2026-123770
- Vendors
- Apache
- Products
- Axis2/Java
Coverage
oldest first · one row per article · UTC- · 5d ago
oss-securityFirst report
Apache Axis2/Java before 2.0.2 vulnerable to XML External Entity injection (CVE-2026-120761)
The XML External Entity (XXE) injection vulnerability in Apache Axis2/Java allows attackers to inject external entities when clients import WSDL/XSD documents via wsdl4j.
- · 5d ago
Apache Axis2/Java before 2.0.2 has SSRF via WS-Addressing endpoints (CVE-2026-123753)
An unauthenticated caller could supply a non-anonymous WS-Addressing address
- · 5d ago
Apache Axis2/Java 2.0.1 before 2.0.2 has XSS in OpenAPI module (CVE-2026-123766)
The Swagger UI page writes the Host header into the page without encoding
- · 5d ago
Apache Axis2/Java before 2.0.2 has unbounded multipart request bodies (CVE-2026-123770)
The multipart/form-data and application/x-www-form-urlencoded builders have no size limit
- · 5d ago
Apache Axis2/Java JSON buffer vulnerability (CVE-2026-120367)
Apache Axis2/Java JSON builders buffered full request bodies without limits, enabling unauthenticated memory exhaustion, fixed in 2.0.2.
- · 5d ago
Apache Axis2/Java SSRF via WSDL/XSD schema import resolution
Apache Axis2/Java before 2.0.2 allows SSRF when building service descriptions from WSDL through unrestricted fetching of absolute URLs in wsdl:import and xsd:import/include locations.
- · 5d ago
Apache Axis2/Java exposeServiceMetadata not enforced on all metadata routes
The exposeServiceMetadata service parameter is enforced only on ?wsdl, ?wsdl2 and ?xsd queries, allowing forced browsing of .wsdl and .xsd routes in Apache Axis2/Java before 2.0.2.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120367 | Memory Exhaustion in Apache Axis2/Java JSON Request Buffering | 7.5 group max | — |