Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-124023— Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper

Quick assessment

Affected
Apache Software Foundation Apache Axis2/C
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Axis2/C 中的 Guththila XML 解析器包装器存在越界读取漏洞。当接收到某些格式错误的 XML 输入时，Guththila 解析器会返回原始输入字节而非正确的事件代码；随后，AXIOM 读取器包装器在未进行范围检查的情况下，将该值用作一个包含十个条目的查找表的索引，导致读取了该表末尾之后的堆内存。未经身份验证的攻击者可以向使用默认解析器（Guththila）构建的服务器发送精心构造的 XML 请求，从而触发该漏洞，导致请求被错误解析，或在某些情况下造成进程崩溃。值得注意的是，此次内存读

AI Predicted 5.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-124023

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper
Source: CVE Program / CVE List V5
Vulnerability Description
Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Axis2/C f2b30c159720cf63ada72f19183828533154c749 ~ 23110287924e79d05a5b4712298c355d1f05c606 -
Apache Software Foundation Apache Axis2/C 0 ~ 2.0.0 -

II. Public POCs for CVE-2026-124023

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-124023

请登录查看更多情报信息。

Other References for CVE-2026-124023 (3)

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-125