Requests with unbounded multipart/form-data or application/x-www-form-urlencoded bodies cause the server to allocate memory and disk space without enforcing size limits, allowing an unauthenticated attacker to exhaust the targeted system’s resources and render services unavailable. The vulnerability is a classic instance of the CWE‑770 weakness, where excessive resource consumption leads to operational disruption.

The issue affects the Apache Software Foundation’s Apache Axis2/Java component in all releases through version 2.0.1. Version 2.0.2 introduces configurable limits on request body size and ensures temporary files are removed, thereby preventing the attack surface described.

This flaw can be abused by any client that can send arbitrarily large messages to a service built on Axis2/Java, without needing credentials. While the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the potential for undisplaced denial of service remains high, especially in environments where Apache Axis2/Java is exposed to the Internet or untrusted networks.