CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering

Q: Who can exploit this issue?

An unauthenticated caller can exploit it by sending a large JSON request to an affected Axis2/Java endpoint that uses the vulnerable JSON message builders, including Gson, Moshi, and HTTP/2 variants.

Q: Are default deployments affected?

Affected releases through 2.0.1 had no request-body size limit in the JSON message builders. Whether a particular deployment is exposed depends on whether it accepts JSON requests through those builders.

Q: What should be done if upgrading cannot happen immediately?

Limit JSON request body sizes before requests reach Axis2/Java, such as at a reverse proxy or other HTTP request-processing layer, to reduce the risk of memory exhaustion. The product-level fix is available in version 2.0.2 through the configurable jsonMaxRequestSize parameter.

Q: How can I determine whether an installation is vulnerable?

Installations of Apache Axis2/Java through version 2.0.1 are affected if they process JSON requests using the Gson, Moshi, or HTTP/2 JSON message builders. Version 2.0.2 adds bounded request-body handling via jsonMaxRequestSize.

Published Nov 6, 2026

Updated

Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Affected Software

1 affected component

Apache Axis2/Java<=2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Axis2/Java to a version that resolves this vulnerability.
Fixed in 2.0.2
Configuration
Configure jsonMaxRequestSize to bound JSON request body size.
Apache Axis2/Java jsonMaxRequestSize

Event History

Nov 9, 2026

CVE Published

via MITRE·10:31 AM

Data Sourced

via MITRE·10:31 AM

DescriptionWeakness

Data Sourced

via NVD·11:17 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated caller can exploit it by sending a large JSON request to an affected Axis2/Java endpoint that uses the vulnerable JSON message builders, including Gson, Moshi, and HTTP/2 variants.

Are default deployments affected?

Affected releases through 2.0.1 had no request-body size limit in the JSON message builders. Whether a particular deployment is exposed depends on whether it accepts JSON requests through those builders.

What should be done if upgrading cannot happen immediately?

Limit JSON request body sizes before requests reach Axis2/Java, such as at a reverse proxy or other HTTP request-processing layer, to reduce the risk of memory exhaustion. The product-level fix is available in version 2.0.2 through the configurable jsonMaxRequestSize parameter.

How can I determine whether an installation is vulnerable?

Installations of Apache Axis2/Java through version 2.0.1 are affected if they process JSON requests using the Gson, Moshi, or HTTP/2 JSON message builders. Version 2.0.2 adds bounded request-body handling via jsonMaxRequestSize.

CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are default deployments affected?

What should be done if upgrading cannot happen immediately?

How can I determine whether an installation is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are default deployments affected?

What should be done if upgrading cannot happen immediately?

How can I determine whether an installation is vulnerable?