Cyber ·
CVE-2026-120367: Apache Axis2/Java accepted JSON request bodies without a size limit
Low-severity advisory posted to the oss-sec list on November 6, 2026. Apache Axis2/Java versions before 2.0.2 buffered entire JSON request bodies, letting an unauthenticated client exhaust server memory with one large request.
Low-severity security advisory posted to the oss-sec list on November 6, 2026, identified as CVE-2026-120367. According to the text, Apache Axis2/Java versions before 2.0.2 buffered entire JSON request bodies without a size limit. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, were affected. An unauthenticated requester could exhaust server memory with one large JSON request. Version 2.0.2 limits JSON request bodies through an adjustable configuration.
The original content is a machine translation of a public mailing list advisory. To consult and verify, search for the identifier CVE-2026-120367 on the official Apache Axis2 project page or a recognized vulnerability database, and confirm the affected versions and the default size setting before acting.
Relevance for an organization: if internal systems or exposed services use Axis2/Java, the practical steps are to inventory versions, plan the upgrade and define the size limit. Rota Nacional does not patch third-party libraries and does not replace this work. If the team uses AI to study the advisory, do not paste real configurations, logs or request examples containing personal data. The platform detects CPF, CNPJ, email, phone and person names before any model runs and applies the policy chosen by the organization.
Original source: CVE-2026-120367: Apache Axis2/Java armazenava corpos JSON de requisição sem limite