Server-Side Request Forgery Vulnerability in Apache Axis2/Java

CVE-2026-120832

What is CVE-2026-120832?

A server-side request forgery vulnerability exists in Apache Axis2/Java. This issue arises when Axis2 processes a WSDL, allowing attackers to manipulate service descriptions. The Java implementation can fetch absolute URLs from malicious WSDLs or schemas due to a lack of scheme and host restrictions in the wsdl:import, xsd:import, and xsd:include elements. As a result, an attacker could route requests to arbitrary internal or external hosts. Users running version 2.0.1 are urged to upgrade to version 2.0.2, which addresses this security flaw.

References