CVE-2026-123770 · Package
NO FIX YET · SEE WHAT TO DO
Apache Axis2/Java reads multipart and form-urlencoded request bodies with no size limit and leaves multipart temporary files behind. An unauthenticated caller can send large requests to exhaust server memory or disk.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Axis2/Java service reachable over the network that accepts multipart or form-urlencoded messages is exposed, because the request body is read without a size limit. Services not reachable from untrusted networks, or not using Axis2 at all, can skip it.
Not affected if axis2-not-used, not-exposed-to-network
Who cares apache-axis2, java, web-services
axis2-kernel in pom.xml or the WAR's WEB-INF/lib.2.0.2 or later, which bounds these bodies with configurable limits and deletes temporary files.Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet container's post-size limit did not apply, and multipart temporary files were not deleted. An unauthenticated caller could exhaust memory or disk. Version 2.0.2 bounds these bodies with configurable limits and deletes temporary files. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.