CVE-2026-120761

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java.

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:import were parsed by wsdl4j's own XML parser, which processes DOCTYPE declarations and external entities. An attacker who controls a WSDL, or a document it imports, could therefore read…

9. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-120761