CVE-2026-120367

EUVD-2026-119980

09.11.2026, 11:17

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
apache	axis2/java	𝑥 < 2.0.2	CNA

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

Vulnerability Media Exposure

[GERMAN] Apache Axis2: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Apache Axis2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, oder einen Denial of Service Angriff durchzuführen.
Published: 2026-11-08T23:00:00+00:00

References

https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html

https://github.com/apache/axis-axis2-java-core/commit/aea2671e3c5ebd8638d37db30d69639223366d5d

https://lists.apache.org/thread.html/kf6goprhhtvfzb6lwnbvnors7xnq0w0r

http://www.openwall.com/lists/oss-security/2026/11/06/26