CVE-2026-123753
Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
| CWE | CWE-918 |
| Vendor | apache software foundation |
| Product | apache axis2/java |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Get instant alerts for apache software foundation apache axis2/java
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache axis2/java are published — delivered to Slack, Telegram or Discord.