MavenPackage

org.apache.axis:axis

8 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release: 1.4 (Apr 23, 2006): affected by 6 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 8 · 2 critical, 1 high

Dependents: 469
Releases: 1 since 1.4 (Apr 23, 2006)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-90436
Affects 1.4 (through the newest release)
CVE-2023-51441
No published release is affected
No published release is affected
CVE-2023-40743
Affects 1.4 (through the newest release)
CVE-2019-0227
Affects 1.4 (through the newest release)
CVE-2018-8032
Affects 1.4 (through the newest release)
CVE-2014-3596
Affects 1.4 (through the newest release)
CVE-2012-5784
Affects 1.4 (through the newest release)
CVE-2007-2353
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

CVE-2026-90436Critical
Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2023-51441High 7.2
Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API
Affected: through 1.3.
Fixed in 1.4 (released Apr 23, 2006, 6467 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 1.4, is not affected.
CVE-2023-40743Critical 9.8
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2019-0227Unrated
A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2018-8032Unrated
Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2014-3596Unrated
The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's…
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2012-5784Unrated
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message…
Affected: through 1.4.
No fix released. The latest release, 1.4, is still affected.
CVE-2007-2353Unrated
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the…
Affected: fixed in 1.2.
Fixed in 1.4 (released Apr 23, 2006, 372 days before disclosure, the advisory names 1.2, which was never published).
The latest release, 1.4, is not affected.