CVE-2026-124023: Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper
Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Axis2/Cto a version that resolves this vulnerability.Patch 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache Axis2/C deployments through version 2.0.0 are affected when they process XML requests using the Guththila parser, which is the default parser.
What does an attacker need to exploit it?
An unauthenticated client only needs to send a crafted malformed XML request to a reachable affected server. No authentication is required.
What is the likely impact of a successful trigger?
The malformed request can be parsed incorrectly and may crash the process. Although heap memory is read past the lookup table, the disclosed memory is not returned to the client.
What can be done before the next release is available?
Apply commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6. The fix is also planned for the next release.