# CVE-2026-120367: Apache Axis2 denial of service via unbounded JSON request buffering

Source: https://junglewise.ai/threats/cve-2026-120367-allocation-of-resources-without-limits-or-throttling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-120367 · Severity: info · Published 2026-11-09

Apache Axis2 is a web services framework that processes SOAP and JSON messages for enterprise applications. An attacker can send a large JSON request to exhaust the server's memory, causing the service to become unavailable. This affects unauthenticated users and requires no special privileges or user interaction.

Technologies: [Apache Axis2\](https://junglewise.ai/threats/technologies/axis2). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-120367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120367 being exploited in the wild.

**How severe is CVE-2026-120367?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Apache Axis2\ through 2.0.1.

**Is there a fix for CVE-2026-120367?** Yes: fixed in 2.0.2. Until then: Upgrade to Apache Axis2 2.0.2 or later, which introduces the jsonMaxRequestSize configuration parameter. If immediate upgrade is not possible, restrict network access to Axis2 endpoints or implement reverse-proxy rate limiting on JSON request sizes.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-09"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120367 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120367?** Check whether you run Apache Axis2\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.2

Upgrade to Apache Axis2 2.0.2 or later, which introduces the jsonMaxRequestSize configuration parameter. If immediate upgrade is not possible, restrict network access to Axis2 endpoints or implement reverse-proxy rate limiting on JSON request sizes.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-09"}]

## Technical details

The JSON message builders (Gson, Moshi, HTTP/2 variants) in Apache Axis2 buffer the entire request body without size limits, allowing an unauthenticated attacker to trigger memory exhaustion via a large JSON payload. This is a classic resource exhaustion vulnerability affecting the request parsing stage before authentication occurs. Version 2.0.2 introduces the configurable jsonMaxRequestSize parameter to bound request sizes.

## Affected products

- Apache Axis2 through 2.0.1

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html](https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html)

## Related threats

- [Apache Axis2 server-side request forgery in WSDL processing](https://junglewise.ai/threats/cve-2026-120832-server-side-request-forgery-ssrf-vulnerability-in-apache-axis2)
- [Apache Axis2 XML External Entity injection in WSDL import resolution](https://junglewise.ai/threats/cve-2026-120761-improper-restriction-of-xml-external-entity-reference)