Axis2/Java (< 2.0.2) - CraftedSignal Threat Feed

Apache Axis2/Java: SSRF via WS-Addressing endpoints (CVE-2026-123753)

hello@craftedsignal.io — Fri, 06 Nov 2026 19:23:13 +0000

Apache Axis2/Java versions prior to 2.0.2 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can supply a non-anonymous WS-Addressing 'wsa:ReplyTo' or 'wsa:FaultTo' header, causing the service to initiate a connection to the specified address. This can lead to unauthorized access to internal resources or sensitive network infrastructure.

Impact

Successful exploitation allows attackers to perform requests to internal hosts accessible by the Axis2 server, potentially bypassing network segmentation or accessing internal services that do not require authentication.

Recommendation

Upgrade Apache Axis2/Java to version 2.0.2 or later immediately.
Audit web server and application logs for unusual 'wsa:ReplyTo' or 'wsa:FaultTo' address patterns in SOAP headers.
Restrict egress traffic from the application server to prevent unauthorized internal network access.

Apache Axis2/Java: Cross-site scripting in OpenAPI module (CVE-2026-123766)

hello@craftedsignal.io — Fri, 06 Nov 2026 19:23:09 +0000

Apache Axis2/Java versions prior to 2.0.2 are vulnerable to cross-site scripting (XSS) within the OpenAPI module. The vulnerability occurs because the Swagger UI page improperly handles the Host header, injecting it into the web page content without sanitization. This allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin.

Impact

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the Axis2 origin, potentially leading to session hijacking or unauthorized actions performed by users viewing the affected Swagger UI page.

Recommendation

Update Apache Axis2/Java to version 2.0.2 or later to remediate the underlying XSS vulnerability in the OpenAPI module.
As a temporary mitigation, utilize a web application firewall (WAF) to inspect and sanitize the Host header value in incoming requests before they reach the backend application.

Apache Axis2/Java: Unbounded JSON request body memory exhaustion (CVE-2026-120367)

hello@craftedsignal.io — Fri, 06 Nov 2026 19:23:03 +0000

Apache Axis2/Java versions before 2.0.2 contain an "Allocation of Resources Without Limits or Throttling" vulnerability. The JSON message builders, specifically the Gson, Moshi, and HTTP/2 variants, buffer the entire request body into memory without size constraints. An unauthenticated attacker can exploit this behavior by sending a specially crafted, excessively large JSON request to the server, resulting in memory exhaustion and a potential denial-of-service (DoS) condition. Version 2.0.2 introduces configurable limits to mitigate this risk.

Impact

The primary risk is a denial-of-service condition caused by heap memory exhaustion, which can crash the JVM or cause severe performance degradation for the affected service.

Recommendation

Upgrade Apache Axis2/Java to version 2.0.2 or later to enable configurable request body size limits.
Implement upstream request size restrictions at the WAF or reverse proxy layer to drop excessively large HTTP POST requests before they reach the Axis2 service.

Apache Axis2/Java: Inconsistent enforcement of exposeServiceMetadata (CVE-2026-123779)

hello@craftedsignal.io — Fri, 06 Nov 2026 19:22:53 +0000

Apache Axis2/Java is vulnerable to forced browsing due to inconsistent enforcement of the exposeServiceMetadata configuration parameter. While the parameter is intended to disable metadata exposure, it fails to restrict access to packaged .wsdl and .xsd files, as well as the named-WSDL ?wsdl=NAME route in the standalone HTTP server. This vulnerability allows an attacker to retrieve service metadata even when explicitly disabled.

Impact

The vulnerability may lead to unauthorized information disclosure of internal service configurations and API definitions, potentially aiding further reconnaissance of the target infrastructure.

Recommendation

Upgrade Apache Axis2/Java to version 2.0.2 or later to ensure the exposeServiceMetadata configuration is correctly enforced across all metadata endpoints.
Review public-facing Axis2/Java instances to identify and restrict access to sensitive WSDL and XSD metadata routes until patches are applied.