Resource Allocation Vulnerability in Apache Axis2/Java

CVE-2026-123770

What is CVE-2026-123770?

A vulnerability exists in Apache Axis2/Java affecting versions up to 2.0.1, due to the improper handling of multipart/form-data and application/x-www-form-urlencoded message builders. These components read the request body directly from the transport stream without enforcing any size limits, allowing unauthenticated users to exhaust memory or disk resources. This oversight results in the failure to apply the servlet container's post-size limit and does not remove the temporary files created during these operations. Users are advised to upgrade to version 2.0.2, which introduces configurable limits and ensures the cleanup of temporary files to mitigate this issue.

References