Skip to content
OpenAdvisories
Medium WID-SEC-2026-4415 7 CVEs

Apache Axis2: Mehrere Schwachstellen

Published Nov 8, 2026 · Updated Nov 9, 2026 · Revision 2 · de

Vendor: Apache Product: Axis2 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Axis2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, oder einen Denial of Service Angriff durchzuführen.

Product

Axis2 ist eine Web-Service / SOAP / WSDL Engine.

Vulnerabilities 7

  • Critical 9.1
    CVE-2026-120761

    Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents

    Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the docume…

    Apache Software Foundation Apache Axis2/Java
  • Critical 9.1
    CVE-2026-123753 Public exploit

    Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

    Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault,…

    Apache Software Foundation Apache Axis2/Java
  • High 7.5
    CVE-2026-120367

    Apache Axis2/Java: unbounded JSON request body buffering

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust …

    Apache Software Foundation Apache Axis2/Java
  • High 7.5
    CVE-2026-123770

    Apache Axis2/Java: Unbounded multipart and form-encoded request bodies

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet…

    Apache Software Foundation Apache Axis2/Java
  • Medium 6.5
    CVE-2026-120832

    Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

    Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import …

    Apache Software Foundation Apache Axis2/Java
  • Medium 6.1
    CVE-2026-123766

    Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page

    Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page wi…

    Apache Software Foundation Apache Axis2/Java
  • Medium 5.3
    CVE-2026-123779

    Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

    Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-…

    Apache Software Foundation Apache Axis2/Java

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-119978, EUVD-2026-119936, EUVD-2026-119934, EUVD-2026-119980, EUVD-2026-119930, EUVD-2026-119929, EUVD-2026-119935

  2. #1

    Initiale Fassung

References