Resource Allocation Vulnerability in Apache Axis2/Java

CVE-2026-120367

What is CVE-2026-120367?

A resource allocation vulnerability exists in Apache Axis2/Java, specifically in its JSON message builders such as Gson, Moshi, and the HTTP/2 variants. These builders lack a limit on the size of buffered request bodies, enabling unauthenticated users to send excessively large JSON requests that can lead to server memory exhaustion. To mitigate this issue, users are urged to upgrade to version 2.0.2, which introduces the configurable jsonMaxRequestSize parameter to limit JSON request sizes effectively.

References