Vulnerability · low
Apache Axis2 unbounded JSON request body buffering (CVE-2026-120367)
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apache Axis2/Java servers using JSON message builders before 2.0.2
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
What to do
- Upgrade Apache Axis2/Java to 2.0.2 or later.
The Brief
- Apache Axis2/Java versions before 2.0.2 are affected by CVE-2026-120367, an unbounded JSON request body buffering issue.
- The advisory classifies it as allocation of resources without limits or throttling.
- The oss-sec post names the Gson, Moshi and HTTP/2 JSON message builders and rates the severity as low.
Why it matters
Request bodies processed by affected JSON message builders are buffered without a size limit, so developers running Axis2/Java below 2.0.2 should check and upgrade.
The checklist behind the tier
Checklist · 1 of 10 yes
| Yes | Hits tech teams | Axis2 is a Java server-side web services framework that developers and ops teams run. |
| No | Core infrastructure | A single Java web services framework, not software nearly every team runs. |
| No | Popular tool | Axis2 is an Apache project but a niche legacy SOAP and REST framework, not mainstream. |
| No | Exploited in the wild | Open Source Security post describes the flaw only; no source reports observed attacks. |
| No | Public exploit | Open Source Security post gives a description and affected versions; no exploit or PoC mentioned. |
| No | Remote, no login | Open Source Security post does not say whether the attack needs credentials. |
| No | Full takeover | Open Source Security post describes resource allocation without limits, which is denial of service, not code execution. |
| No | Secrets exposed | Open Source Security post reports no data theft or exposure. |
| No | Supply chain | Open Source Security post describes a resource allocation flaw, not a compromised channel or malicious code. |
| No | No fix yet | Open Source Security post says affected versions are before 2.0.2, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-sec mailing list
Open Source Security
CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering
Source
CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering ↗ Open Source Security · 21h ago
First seen · 1 source · Full story page · How tiers are decided