Deserialization of Untrusted Data

Overview org.apache.axis2:axis2-kernel is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. Affected versions of this package are vulnerable to Deserialization of Untrusted Data the Tribes-based clustering channel in...

EUVD-2026-49849

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...