{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapacheaxis2java/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:*:*:*:*:*:java:*:*"],"_cs_cves":[{"id":"CVE-2026-120367"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java versions before 2.0.2 contain an \u0026quot;Allocation of Resources Without Limits or Throttling\u0026quot; vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.\u003c/li\u003e\n\u003cli\u003eImplement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:23:03Z","date_published":"2026-11-06T19:23:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/","summary":"Apache Axis2/Java versions prior to 2.0.2 are vulnerable to a denial-of-service condition where unauthenticated attackers can exhaust server memory by sending large, unbounded JSON requests.","title":"Apache Axis2/Java: Unbounded JSON request body memory exhaustion (CVE-2026-120367)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:*:*:*:*:*:java:*:*"],"_cs_cves":[{"id":"CVE-2026-123779"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java is vulnerable to forced browsing due to inconsistent enforcement of the exposeServiceMetadata configuration parameter. While the parameter is intended to disable metadata exposure, it fails to restrict access to packaged .wsdl and .xsd files, as well as the named-WSDL ?wsdl=NAME route in the standalone HTTP server. This vulnerability allows an attacker to retrieve service metadata even when explicitly disabled.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability may lead to unauthorized information disclosure of internal service configurations and API definitions, potentially aiding further reconnaissance of the target infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Axis2/Java to version 2.0.2 or later to ensure the exposeServiceMetadata configuration is correctly enforced across all metadata endpoints.\u003c/li\u003e\n\u003cli\u003eReview public-facing Axis2/Java instances to identify and restrict access to sensitive WSDL and XSD metadata routes until patches are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T19:22:53Z","date_published":"2026-11-06T19:22:53Z","id":"https://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/","summary":"Apache Axis2/Java contains a forced browsing vulnerability where the exposeServiceMetadata parameter is not enforced on specific routes, allowing unauthorized metadata disclosure.","title":"Apache Axis2/Java: Inconsistent enforcement of exposeServiceMetadata (CVE-2026-123779)","url":"https://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:axis2:*:*:*:*:*:java:*:*","version":"https://jsonfeed.org/version/1.1"}