{"id":"CVE-2026-120367","kind":"vulnerability","aliases":["CVE-2026-120367"],"related":[],"title":"Apache Axis2/Java: unbounded JSON request bodies let callers exhaust server memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.","summary":"Apache Axis2/Java's JSON message builders (Gson, Moshi and HTTP/2 variants) read the whole request body into memory with no size limit. An unauthenticated caller can send a very large JSON request and exhaust the server's memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-axis2","java","package","web-services"],"not_affected_if":["not-using-json-builders"],"how_to_check":"- Check the Axis2/Java version in your dependencies, for example with `mvn dependency:tree | grep axis2` or by inspecting the WAR's lib directory.\n- Confirm whether JSON services are exposed through the Gson, Moshi or HTTP/2 message builders.","fix":"- Apache Axis2/Java: upgrade to `2.0.2`, which bounds JSON request bodies with the jsonMaxRequestSize parameter.","status":"open","published_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:55+00:00","updated_at":"2026-11-09T11:26:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T11:26:55Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Axis2/Java: upgrade to `2.0.2`, which bounds JSON request bodies with the jsonMaxRequestSize parameter.","reach":"internet","title":"Apache Axis2/Java: unbounded JSON request bodies let callers exhaust server memory","impact":"low","summary":"Apache Axis2/Java's JSON message builders (Gson, Moshi and HTTP/2 variants) read the whole request body into memory with no size limit. An unauthenticated caller can send a very large JSON request and exhaust the server's memory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-axis2","java","web-services"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated caller exhausts server memory, causing denial of service","analyst_note":"","how_to_check":"- Check the Axis2/Java version in your dependencies, for example with `mvn dependency:tree | grep axis2` or by inspecting the WAR's lib directory.\n- Confirm whether JSON services are exposed through the Gson, Moshi or HTTP/2 message builders.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-using-json-builders"],"who_is_affected":"Applications running Apache Axis2/Java through version 2.0.1 that accept JSON requests through the Gson, Moshi or HTTP/2 builders are exposed. Services that do not use Axis2 JSON handling, or that sit behind a request size limit at a proxy, are less exposed. The sources do not say whether a default configuration is vulnerable.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000766,"input_tokens":4647,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120367':14A,17A '-2026':13A,16A '2.0.1':125C '2.0.2':109C,133C 'affect':121C 'alloc':64C 'apach':1A,19B,26B,73C,122C 'apache-axis2':18B 'axis2':20B 'axis2/java':2A,27B,74C,123C 'bodi':6A,41B,90C,113C 'bound':110C 'buffer':86C 'builder':31B,78C 'caller':8A,50B,98C 'configur':116C 'could':99C 'cve':12A,15A 'entir':88C 'exhaust':9A,59B,100C 'fix':135C 'gson':32B,81C 'http/2':35B,84C 'includ':79C 'issu':120C,137C 'java':21B 'json':4A,29B,56B,76C,106C,111C 'jsonmaxrequests':117C 'larg':55B,105C 'let':7A 'limit':47B,68C,94C 'memori':11A,43B,63B,102C 'messag':30B,77C 'moshi':33B,82C 'packag':22B 'paramet':118C 'read':37B 'recommend':128C 'request':5A,40B,57B,89C,107C,112C 'resourc':66C 'send':52B 'server':10A,61B,101C 'servic':25B 'size':46B,93C 'throttl':70C 'unauthent':49B,97C 'unbound':3A 'upgrad':130C 'user':126C 'variant':36B,85C 'version':108C,132C 'vulner':71C 'web':24B 'web-servic':23B 'whole':39B 'without':67C","nicknames":[],"mitigations":[],"who_affected":"Applications running Apache Axis2/Java through version 2.0.1 that accept JSON requests through the Gson, Moshi or HTTP/2 builders are exposed. Services that do not use Axis2 JSON handling, or that sit behind a request size limit at a proxy, are less exposed. The sources do not say whether a default configuration is vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheaxis2","java","package","unknown","webservices"],"campaign_type":null,"search_a":"'-120367':14A,17A '-2026':13A,16A 'apach':1A 'axis2/java':2A 'bodi':6A 'caller':8A 'cve':12A,15A 'exhaust':9A 'json':4A 'let':7A 'memori':11A 'request':5A 'server':10A 'unbound':3A","search_b":"'apach':19B,26B 'apache-axis2':18B 'axis2':20B 'axis2/java':27B 'bodi':41B 'builder':31B 'caller':50B 'exhaust':59B 'gson':32B 'http/2':35B 'java':21B 'json':29B,56B 'larg':55B 'limit':47B 'memori':43B,63B 'messag':30B 'moshi':33B 'packag':22B 'read':37B 'request':40B,57B 'send':52B 'server':61B 'servic':25B 'size':46B 'unauthent':49B 'variant':36B 'web':24B 'web-servic':23B 'whole':39B","search_c":"'2.0.1':125C '2.0.2':109C,133C 'affect':121C 'alloc':64C 'apach':73C,122C 'axis2/java':74C,123C 'bodi':90C,113C 'bound':110C 'buffer':86C 'builder':78C 'caller':98C 'configur':116C 'could':99C 'entir':88C 'exhaust':100C 'fix':135C 'gson':81C 'http/2':84C 'includ':79C 'issu':120C,137C 'json':76C,106C,111C 'jsonmaxrequests':117C 'larg':105C 'limit':68C,94C 'memori':102C 'messag':77C 'moshi':82C 'paramet':118C 'recommend':128C 'request':89C,107C,112C 'resourc':66C 'server':101C 'size':93C 'throttl':70C 'unauthent':97C 'upgrad':130C 'user':126C 'variant':85C 'version':108C,132C 'vulner':71C 'without':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120367","severity":null,"published_at":"2026-11-09T11:17:21+00:00","modified_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[{"id":107110,"url":"https://github.com/apache/axis-axis2-java-core/commit/aea2671e3c5ebd8638d37db30d69639223366d5d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}