CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering

The Brief

Apache Axis2/Java versions before 2.0.2 are affected by CVE-2026-120367, an unbounded JSON request body buffering issue.
The advisory classifies it as allocation of resources without limits or throttling.
The oss-sec post names the Gson, Moshi and HTTP/2 JSON message builders and rates the severity as low.

Why it matters

Request bodies processed by affected JSON message builders are buffered without a size limit, so developers running Axis2/Java below 2.0.2 should check and upgrade.

Who’s affected

Apache Axis2/Java users running versions before 2.0.2

What to do

Upgrade Apache Axis2/Java to 2.0.2 or later.

Apache Axis2/Java 2.0.2
CVE-2026-120367
#apache-axis2
#java
#security
#cve-2026-120367
#json
#resource-exhaustion

Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants…

Read the full story at seclists.org ↗

Timeline

Nov 6
Vulnerability disclosed on the oss-sec mailing list
Nov 6 · 6:26 PM
Open Source Security
CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering