Cyber ·
CVE-2026-124023: out-of-bounds read in the Guththila XML reader wrapper of Apache Axis2/C
Low-severity advisory on an out-of-bounds read in the Guththila XML reader wrapper of Apache Axis2/C, triggered by certain malformed XML inputs. Posted to the oss-sec list on November 11, 2026.
Advisory CVE-2026-124023, posted by Robert Lazarski on the oss-sec list, describes an out-of-bounds read in the wrapper of the Guththila XML parser in Apache Axis2/C. With certain malformed XML inputs, the parser returned a raw byte of the input instead of an event code, and the AXIOM reader wrapper used that value as an index, causing the out-of-bounds read. The reported severity is low.
The affected versions are Apache Axis2/C up to 2.0.0 and a range of development versions before a commit identified in the advisory. The text available to Radar is truncated, so fix and mitigation details are not included here.
Relevance to Rota Nacional: the platform does not patch or protect third-party C libraries, and this item does not describe a Rota feature. If your team uses AI to study the advisory or draft tests, do not send production code, logs or XML containing personal data; detection of CPF, CNPJ, e-mail, phone and names applies your chosen policy before any model runs.
To verify, consult the original advisory in the oss-sec record dated November 11, 2026, confirm the Axis2/C version you run, and compare it with the fix list published by the Apache project.