CVE-2026-120832

Apache Axis2/Java versions through 2.0.1 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The issue occurs when the application builds a service description from a WSDL using ServiceClient , AxisService.createClientSideAxisService , or WSDLToAxisServiceBuilder . Because the s...

CVE-2026-120832

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and...

CVE-2026-120832 Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and...

PT-2026-140347

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injectio...

PT-2026-140348

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not...

CVE-2026-123766: Apache Software Foundation Apache Axis2/Java: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module…

Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injectio...

CVE-2026-123770: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not...

CVE-2026-120832: Apache Software Foundation Apache Axis2/Java: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and...

CVE-2026-123753: Apache Software Foundation Apache Axis2/Java: Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

PT-2026-140346

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

PT-2026-140338

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import locations and in xsd:import and...

PT-2026-140357

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON reques...

PT-2026-140337

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...

CVE-2026-120367: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON reques...

PT-2026-140358

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-120761: Apache Software Foundation Apache Axis2/Java: Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...

CVE-2026-123779: Apache Software Foundation Apache Axis2/Java: Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

Exploit for CVE-2026-123753

CVE-2026-123753 Apache Axis2/Java WS-Addressing wsa:ReplyTo...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713: Deserialization of Untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...