Out-of-Bounds Read Vulnerability in Apache Axis2/C's XML Parser

CVE-2026-124023

What is CVE-2026-124023?

The Guththila XML parser wrapper of Apache Axis2/C is susceptible to an out-of-bounds read vulnerability triggered by malformed XML input. This occurs when the parser returns a raw input byte instead of an event code, leading to incorrect indexing into a lookup table by the AXIOM reader wrapper. This improper handling allows an unauthenticated client to exploit the vulnerability by sending crafted XML requests, which may cause the server process to read memory beyond allocated ranges, potentially leading to application crashes. It is crucial for users to update to the latest version to avoid such security issues, as the fix has been incorporated in upcoming releases.

References