Apache Axis2/Java: Unbounded JSON request body memory exhaustion (CVE-2026-120367)

Apache Axis2/Java versions before 2.0.2 contain an "Allocation of Resources Without Limits or Throttling" vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.

Impact

The primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.

Recommendation

• Upgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.
• Implement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.