Is CVE-2026-124023 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-124023 being exploited in the wild.

How severe is CVE-2026-124023?

Informational severity, published 12 November 2026.

Is there a fix for CVE-2026-124023?

Yes: fixed in next release after 2.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-124023 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-124023?

Check whether you run Apache Axis2/C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-124023: Apache Axis2/C out-of-bounds read in Guththila XML parser

CVE-2026-124023 · Severity: info · Published 2026-11-12

Apache Axis2/C is a web services framework that parses XML requests from clients. An attacker can send a specially crafted XML document with malformed content to trigger an out-of-bounds memory read in the default Guththila XML parser. While the leaked memory is not returned to the attacker, this can cause the server process to crash, leading to denial of service.

Vendors: Apache.

Quick answers

Is CVE-2026-124023 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-124023 being exploited in the wild.
How severe is CVE-2026-124023?: Informational severity, published 12 November 2026.
Which products and versions are affected?: Apache Axis2/C through 2.0.0.
Is there a fix for CVE-2026-124023?: Yes: fixed in next release after 2.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-124023 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-124023?: Check whether you run Apache Axis2/C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: next release after 2.0.0

Technical details

The Guththila XML parser's fallback path returns raw input bytes instead of defined event constants when parsing malformed XML (e.g. unrecognized declarations like <!ENTITY). The AXIOM reader wrapper then uses this unvalidated value as an index into a 10-element event_map array without bounds checking, triggering a CWE-125/CWE-129 out-of-bounds read of heap memory. An unauthenticated network client can trigger this by sending a crafted XML request, potentially crashing the server.

Affected products

Apache Axis2/C through 2.0.0

Timeline

2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.