Posted by Robert Lazarski on Nov 06 Severity: low Affected versions: - Apache Axis2/Java before 2.0.2 Description: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable...

Read the full article at oss-security →