MavenPackage

axis:axis

7 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release: 1.4 (Apr 23, 2006): affected by 6 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 7 · 2 critical, 1 high

Dependents: 384
Releases: 13 since 1.0 (Nov 22, 2005)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-90436
Affects 1.0 to 1.4 (through the newest release)
CVE-2023-51441
Affects 1.0 to 1.3 (1.4 is outside it)
CVE-2023-40743
Affects 1.0 to 1.4 (through the newest release)
CVE-2019-0227
Affects 1.0 to 1.4 (through the newest release)
CVE-2018-8032
Affects 1.0 to 1.4 (through the newest release)
CVE-2014-3596
Affects 1.0 to 1.4 (through the newest release)
CVE-2012-5784
Affects 1.0 to 1.4 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-90436Critical
Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2023-51441High 7.2
Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API
Affected: through 1.3.
Fixed in 1.4 (released Apr 23, 2006, 6467 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 1.4, is not affected.
CVE-2023-40743Critical 9.8
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2019-0227Unrated
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2018-8032Unrated
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2014-3596Unrated
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's…
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2012-5784Unrated
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message…
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.