{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/axis2/java--2.0.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:axis2:*:*:*:*:*:java:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120367"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Axis2/Java (\u003c 2.0.2)","Axis2/Java (\u003c= 2.0.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Axis2/Java versions before 2.0.2 contain an \u0026quot;Allocation of Resources Without Limits or Throttling\u0026quot; vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.\u003c/li\u003e\n\u003cli\u003eImplement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:52:02Z","date_published":"2026-11-06T19:23:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/","summary":"Apache Axis2/Java versions prior to 2.0.2 are vulnerable to a denial-of-service condition where unauthenticated attackers can exhaust server memory by sending large, unbounded JSON requests.","title":"Apache Axis2/Java: Unbounded JSON request body memory exhaustion (CVE-2026-120367)","url":"https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Axis2/Java (\u003c= 2.0.1)","version":"https://jsonfeed.org/version/1.1"}