https://feed.craftedsignal.io/cpes/cpe2.3aapacheaxis2java/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 19:23:03 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/Fri, 06 Nov 2026 19:23:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/Apache Axis2/Java versions prior to 2.0.2 are vulnerable to a denial-of-service condition where unauthenticated attackers can exhaust server memory by sending large, unbounded JSON requests.Apache Axis2/Java versions before 2.0.2 contain an "Allocation of Resources Without Limits or Throttling" vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.

Impact

The primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.

Recommendation

• Upgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.
• Implement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.

]]>lowadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/Fri, 06 Nov 2026 19:22:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-axis2-forced-browsing/Apache Axis2/Java contains a forced browsing vulnerability where the exposeServiceMetadata parameter is not enforced on specific routes, allowing unauthorized metadata disclosure.Apache Axis2/Java is vulnerable to forced browsing due to inconsistent enforcement of the exposeServiceMetadata configuration parameter. While the parameter is intended to disable metadata exposure, it fails to restrict access to packaged .wsdl and .xsd files, as well as the named-WSDL ?wsdl=NAME route in the standalone HTTP server. This vulnerability allows an attacker to retrieve service metadata even when explicitly disabled.

Impact

The vulnerability may lead to unauthorized information disclosure of internal service configurations and API definitions, potentially aiding further reconnaissance of the target infrastructure.

Recommendation

• Upgrade Apache Axis2/Java to version 2.0.2 or later to ensure the exposeServiceMetadata configuration is correctly enforced across all metadata endpoints.
• Review public-facing Axis2/Java instances to identify and restrict access to sensitive WSDL and XSD metadata routes until patches are applied.

]]>lowadvisory