Is CVE-2026-123770 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123770 being exploited in the wild.

How severe is CVE-2026-123770?

Informational severity, published 9 November 2026.

Which products and versions are affected?

Apache Axis2/Java through 2.0.1.

How is CVE-2026-123770 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123770?

Check whether you run Apache Axis2/Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123770: Apache Axis2/Java unrestricted resource allocation in form data parsing

CVE-2026-123770 · Severity: info · Published 2026-11-09

Apache Axis2/Java is a web services framework that processes incoming SOAP messages and form data. The form data message parsers lacked size limits, allowing unauthenticated attackers to exhaust memory or disk space by sending oversized multipart or URL-encoded requests. An attacker can cause denial of service or potentially trigger other resource exhaustion attacks against applications using vulnerable versions.

Technologies: Apache Axis2/Java. Vendors: Apache.

Quick answers

Is CVE-2026-123770 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123770 being exploited in the wild.
How severe is CVE-2026-123770?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Apache Axis2/Java through 2.0.1.
Is there a fix for CVE-2026-123770?: Yes: fixed in 2.0.2. Until then: Configure the new size limit parameters in axis2.xml: multipartMaxRequestSize, multipartMaxFileSize, formUrlEncodedMaxRequestSize, mtomMaxRequestSize, and soapMaxRequestSize to values appropriate for your deployment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123770 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123770?: Check whether you run Apache Axis2/Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.0.2

Configure the new size limit parameters in axis2.xml: multipartMaxRequestSize, multipartMaxFileSize, formUrlEncodedMaxRequestSize, mtomMaxRequestSize, and soapMaxRequestSize to values appropriate for your deployment.

Technical details

The multipart/form-data and application/x-www-form-urlencoded message builders in Axis2/Java read request bodies directly from the transport stream without size limits, bypassing the servlet container's post-size limit and failing to delete temporary multipart files. An unauthenticated network attacker can trigger unlimited memory or disk exhaustion. Version 2.0.2 adds configurable limits and proper cleanup.

Affected products

Apache Axis2/Java through 2.0.1

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.