Apache Axis2/Java allowed JSON request bodies to be fully buffered into memory without imposing any size limits. The lack of a maximum size for JSON payloads means that an attacker can send a very large JSON payload over an unauthenticated HTTP connection, leading the server to consume all available memory until it becomes unresponsive. This vulnerability is a classic example of unchecked allocation of resources and can result in loss of service for all clients.

The vulnerability affects the Apache Axis2/Java library distributed by the Apache Software Foundation. All releases up to and including 2.0.1 are susceptible. Users of these versions should upgrade to Apache Axis2/Java 2.0.2 or newer, which introduces the jsonMaxRequestSize configurable parameter to bound JSON request sizes.

The CVSS score of 7.5 indicates a high severity risk. There is no publicly disclosed exploit for this issue, and EPSS data is unavailable, so the current exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an unauthenticated, remote HTTP client that can send arbitrarily large JSON bodies, exploiting the lack of size throttling.