Executive brief
Apache Axis2/Java, a popular framework for building and deploying web services, contains a critical security flaw in its optional clustering component. If the clustering feature is enabled, an unauthenticated attacker can remotely take full control of the server by sending a specially crafted message to the cluster's communication port. This could lead to complete data theft, service disruption, or the installation of malware on the affected infrastructure.
Technical details
A deserialization of untrusted data vulnerability (CWE-502) exists in the Tribes-based clustering component of Apache Axis2/Java. The flaw is located in the 'org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived' method, which fails to properly validate serialized Java objects received over the cluster channel. An unauthenticated remote attacker with network access to the clustering port can achieve arbitrary code execution by delivering a crafted serialized object. This vulnerability is only present when Tribes clustering is enabled (it is disabled by default). The issue has been addressed in version 2.0.1 by removing the clustering feature entirely.
Affected products
- Apache Software Foundation Axis2/Java 0 through 2.0.0
Timeline
- 2026-07-28: disclosed: Vulnerability disclosed by Apache Software Foundation
- 2026-07-28: advisory: NVD entry published