Axis2/Java (<= 2.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/axis2/java--2.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 19:23:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Axis2/Java: Unbounded JSON request body memory exhaustion (CVE-2026-120367)https://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/Fri, 06 Nov 2026 19:23:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-axis2-json-dos/Apache Axis2/Java versions prior to 2.0.2 are vulnerable to a denial-of-service condition where unauthenticated attackers can exhaust server memory by sending large, unbounded JSON requests.Apache Axis2/Java versions before 2.0.2 contain an "Allocation of Resources Without Limits or Throttling" vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.

Impact

The primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.

Recommendation

  • Upgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.
  • Implement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.
]]>lowadvisory