org.apache.axis2/axis2-transport-http vulnerabilities

Latest org.apache.axis2/axis2-transport-http CVEs

Newest publication first

1. CVE-2026-123779 Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

   Published 2026-11-09

   Medium·CVSS 5.3 EPSS 0.22%

   Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route...

2. CVE-2012-5785 Apache Axis2 has Improper Input Validation

   Published 2012-11-04

   Medium·CVSS 5.8 EPSS 2.2%

   Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.