Bug#1153309: axis: CVE-2026-90436

[Salvatore Bonaccorso]

Source: axis
Version: 1.4-29
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security upstream

Hi,

The following vulnerability was published for axis.

CVE-2026-90436[0]:
| ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP
| fault in Apache Axis 1.x allows unauthenticated remote class
| instantiation. When a SOAP <Fault> carries a <detail><exceptionName>
| element, Axis loads the named class and, if a String <data> element
| is also present, instantiates it through its String constructor
| before checking that it is an AxisFault. Loading alone runs the
| class's static initializer. With a suitable class on the
| application's classpath this leads to remote code execution. The
| fault is parsed while the engine resolves the target service, before
| any per-service handler chain runs, so authentication handlers
| configured on a service do not protect against it. This affects all
| Apache Axis 1.x versions through 1.4.    As Axis 1 has been EOL we
| recommend you migrate to a different SOAP engine, such as Apache
| Axis 2/Java. Alternatively you could use a build of Axis with the
| patch from https://github.com/apache/axis-
| axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied.
| The Apache Axis project does not expect to create an Axis 1.x
| release fixing this problem.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-90436
    https://www.cve.org/CVERecord?id=CVE-2026-90436
[1] https://lists.apache.org/thread/8slf0j9gz35z56t0glt5h0ncwlbn4bdz
[2] https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd

Regards,
Salvatore