CVE-2026-120367 · Package
NO FIX YET · SEE WHAT TO DO
Apache Axis2/Java's JSON message builders (Gson, Moshi and HTTP/2 variants) read the whole request body into memory with no size limit. An unauthenticated caller can send a very large JSON request and exhaust the server's memory.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications running Apache Axis2/Java through version 2.0.1 that accept JSON requests through the Gson, Moshi or HTTP/2 builders are exposed. Services that do not use Axis2 JSON handling, or that sit behind a request size limit at a proxy, are less exposed. The sources do not say whether a default configuration is vulnerable.
Not affected if not-using-json-builders
Who cares apache-axis2, java, web-services
mvn dependency:tree | grep axis2 or by inspecting the WAR's lib directory.2.0.2, which bounds JSON request bodies with the jsonMaxRequestSize parameter.Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.