CVE-2026-124023 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache Axis2/C's Guththila XML parser can return a raw input byte where an event code is expected, and the AXIOM wrapper uses it as an unchecked index into a ten-entry table, reading heap memory past its end. An unauthenticated attacker can send a crafted XML request to cause misparsing or, in some cases, a process crash, though the memory read is not returned to the client.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running Apache Axis2/C that parse incoming XML with the default Guththila parser are exposed, since an unauthenticated client can send the crafted request directly. Deployments using a different XML parser, or not exposing Axis2/C to untrusted requests, are less exposed; the sources do not say more.
Not affected if non-guththila-parser
Who cares apache-axis2-c, c, xml-services
2.0.0.23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6, to be included in the next release; no release version is named in the sources.Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.
This page as .md ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.