# CVE-2026-124023: Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper

Status: published. Published: 2026-11-12. Updated: 2026-11-12.

Out-of-bounds Read vulnerability in the Guththila XML parser wrapper of Apache Axis2/C. On some malformed XML input the Guththila parser returned a raw input byte in place of an event code, and the AXIOM reader wrapper used that value as an index into a ten-entry lookup table without checking its range, reading heap memory past the end of the table. An unauthenticated client could trigger this by sending a crafted XML request to a server built with Guththila, the default parser, causing the request to be parsed incorrectly or, in some cases, the process to crash. The memory read is not returned to the client. This issue affects Apache Axis2/C: through 2.0.0. The fix is available in commits 23110287924e79d05a5b4712298c355d1f05c606 and f01683ec10e8fddb87279ec9351b3239021223e6 and will be included in the next release.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: apache) — https://github.com/apache/axis-axis2-c-core/commit/23110287924e79d05a5b4712298c355d1f05c606
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: apache) — https://github.com/apache/axis-axis2-c-core/commit/f01683ec10e8fddb87279ec9351b3239021223e6

## Affected products and versions

- Apache Software Foundation / Apache Axis2/C: ≥ f2b30c159720cf63ada72f19183828533154c749; < 23110287924e79d05a5b4712298c355d1f05c606 (affected, git). Source: CNA: apache
- Apache Software Foundation / Apache Axis2/C: ≥ 0; ≤ 2.0.0 (affected, semver). Source: CNA: apache

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-125

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/apache/axis-axis2-c-core/commit/23110287924e79d05a5b4712298c355d1f05c606 (CNA: apache; patch)

- https://github.com/apache/axis-axis2-c-core/commit/f01683ec10e8fddb87279ec9351b3239021223e6 (CNA: apache; patch)

- https://lists.apache.org/thread/yzmshl8n819pfy2f3p07r9swgh0b3dfz (CNA: apache; vendor-advisory)

- http://www.openwall.com/lists/oss-security/2026/11/12/1 (ADP: CVE)

- https://github.com/apache/axis-axis2-c-core/commit/23110287924e79d05a5b4712298c355d1f05c606 (security@apache.org)

- https://github.com/apache/axis-axis2-c-core/commit/f01683ec10e8fddb87279ec9351b3239021223e6 (security@apache.org)

- https://lists.apache.org/thread/yzmshl8n819pfy2f3p07r9swgh0b3dfz (security@apache.org)

## Provenance

- CNA: apache: https://www.cve.org/CVERecord?id=CVE-2026-124023; retrieved 2026-11-12; source updated 2026-11-12

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124023; retrieved 2026-11-12; source updated 2026-11-12

Revision: 84e2a9e6e9ee39e08c84dd0fa9c7834070ee360a441786d8cf087b024120ae86

Canonical: https://y2.dev/cve/CVE-2026-124023

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.