Cyber ·
CVE-2026-123770: Apache Axis2/Java has no size limit on multipart and form request bodies
Low-severity advisory: Apache Axis2/Java versions before 2.0.2 read multipart and form-encoded bodies without a size limit and did not delete multipart temporary files.
Published on November 6, 2026 in the oss-sec feed and attributed to Robert Lazarski, the advisory describes CVE-2026-123770 in Apache Axis2/Java. According to the text, versions before 2.0.2 accepted multipart/form-data and application/x-www-form-urlencoded requests without a size limit: the message builders read the body directly from the transport stream, so the servlet container's post size limit was not enforced.
The same problem prevented multipart temporary files from being deleted. The severity is classified as low, and the category is unbounded resource allocation or lack of control. The available text is an automatic translation and ends abruptly, so the full list of conditions and mitigations should be checked in the original source.
For anyone using Axis2/Java, the first step is to verify the version in use and plan an upgrade to 2.0.2 or later. Consult the original source in the oss-sec list for November 2026 and the official Apache project notice before concluding the analysis.