CVE-2026-120761 · Package
NO FIX YET · SEE WHAT TO DO
Apache Axis2/Java parses WSDL and imported schema documents with an XML parser that resolves external entities when a client builds a service from a WSDL URL. An attacker who controls the WSDL or an imported document can read local files on the client machine or make the JVM send network requests.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Java code that builds an Axis2 client from a WSDL URL is exposed, because that path enables wsdl4j import resolution. The risk is highest when the WSDL location can be chosen or altered by an outside party. Services that only use hard-coded, trusted WSDL files are less exposed.
Not affected if hard-coded-wsdl, no-wsdl-client
Who cares axis2, java, soap, wsdl
org.apache.axis2:axis2-kernel or axis2 in the build file.ServiceClient or AxisService.createClientSideAxisService with a WSDL URL that comes from outside the system.2.0.2.Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read local files or make the JVM issue network requests. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.