CVE-2026-124023

{
  "etk_id": "ETK-2026-4267",
  "cve_id": "CVE-2026-124023",
  "display_id": "CVE-2026-124023",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-124339",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds read in Apache Axis2/C Guththila XML parser",
  "summary": "Apache Axis2/C through 2.0.0 is affected when it processes XML with the default Guththila parser. An unauthenticated client can send malformed XML that may cause incorrect request handling or crash the service.",
  "mitigation": "Update Apache Axis2/C to a build containing commit 23110287924e79d05a5b4712298c355d1f05c606. Until updated, restrict untrusted clients from submitting XML requests to affected services.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Axis2/C",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= f2b30c159720cf63ada72f19183828533154c749, < 23110287924e79d05a5b4712298c355d1f05c606"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "23110287924e79d05a5b4712298c355d1f05c606"
      ],
      "package_name": "Apache Axis2/C",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.0.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Axis2/C",
      "purl": null
    }
  ],
  "cwes": [
    125
  ],
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 26.153171116666666,
  "t0_at": "2026-11-12T10:38:28.771000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-12T11:29:19.536797+00:00",
      "days": 0.03530978931712963,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T10:38:28.771000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-12T10:38:28.771000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T10:38:28.771000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-124023"
    }
  }
}