Register | Log in

axis

SOAP implementation in Java

Choose email to subscribe with

general

source: axis (main)
version: 1.4-30
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Jakub Adam (DMD) – Emmanuel Bourg (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.4-28+deb11u1
oldstable: 1.4-28+deb12u1
stable: 1.4-29
testing: 1.4-30
unstable: 1.4-30

versioned links

1.4-28+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4-28+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4-29: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4-30: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libaxis-java

action needed

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-90436: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

Created: 2026-11-07 Last update: 2026-11-09 02:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-90436: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

Created: 2026-11-07 Last update: 2026-11-09 02:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:

CVE-2026-90436: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

1 ignored issue:

CVE-2023-51441: ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.

Created: 2026-11-07 Last update: 2026-11-09 02:00

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

libaxis-java-doc could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2026-11-14 12:00

debian/patches: 10 patches to forward upstream low

Among the 14 debian patches available in version 1.4-30 of the package, we noticed the following issues:

10 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-20 22:03

No known security issue in trixie wishlist

There are 2 open security issues in trixie.

2 ignored issues:

CVE-2023-51441: ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF This issue affects Apache Axis: through 1.3. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06 applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem, though contributors that would like to work towards this are welcome.
CVE-2026-90436: ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP <Fault> carries a <detail><exceptionName> element, Axis loads the named class and, if a String <data> element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.

Created: 2025-08-09 Last update: 2026-11-09 02:00

news

[2026-10-25] axis 1.4-30 MIGRATED to testing (Debian testing watch)
[2026-10-20] Accepted axis 1.4-30 (source) into unstable (Emmanuel Bourg)
[2023-11-12] Accepted axis 1.4-28+deb11u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2023-11-05] Accepted axis 1.4-28+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2023-10-22] axis 1.4-29 MIGRATED to testing (Debian testing watch)
[2023-10-17] Accepted axis 1.4-28+deb10u1 (source) into oldoldstable (Markus Koschany)
[2023-10-16] Accepted axis 1.4-29 (source) into unstable (Markus Koschany)
[2021-11-17] Accepted axis 1.4-25+deb9u1 (source all) into oldoldstable (Thorsten Alteholz)
[2018-12-08] axis 1.4-28 MIGRATED to testing (Debian testing watch)
[2018-12-03] Accepted axis 1.4-28 (source) into unstable (Emmanuel Bourg)
[2018-06-14] axis 1.4-27 MIGRATED to testing (Debian testing watch)
[2018-06-08] Accepted axis 1.4-27 (source) into unstable (Emmanuel Bourg)
[2018-06-07] Accepted axis 1.4-26 (source) into unstable (Emmanuel Bourg)
[2017-01-23] axis 1.4-25 MIGRATED to testing (Debian testing watch)
[2017-01-12] Accepted axis 1.4-25 (source all) into unstable (Emmanuel Bourg)
[2016-01-21] axis 1.4-24 MIGRATED to testing (Debian testing watch)
[2016-01-15] Accepted axis 1.4-24 (source all) into unstable (Emmanuel Bourg)
[2015-11-23] axis 1.4-23 MIGRATED to testing (Britney)
[2015-11-17] Accepted axis 1.4-23 (source all) into unstable (Markus Koschany)
[2015-03-10] Accepted axis 1.4-12+deb6u1 (source all amd64) into squeeze-lts (Holger Levsen)
[2014-10-28] axis 1.4-22 MIGRATED to testing (Britney)
[2014-10-17] Accepted axis 1.4-22 (source all) into unstable (Emmanuel Bourg)
[2014-10-03] axis 1.4-21 MIGRATED to testing (Britney)
[2014-10-03] Accepted axis 1.4-16.2+deb7u1 (source all) into proposed-updates->stable-new, proposed-updates (Markus Koschany) (signed by: Miguel Landaeta)
[2014-10-01] Accepted axis 1.4-21 (source all) into unstable (Markus Koschany) (signed by: Miguel Landaeta)
[2013-06-07] axis 1.4-20 MIGRATED to testing (Debian testing watch)
[2013-05-27] Accepted axis 1.4-20 (source all) (Emmanuel Bourg) (signed by: Sylvestre Ledru)
[2013-05-24] axis 1.4-19 MIGRATED to testing (Debian testing watch)
[2013-05-14] Accepted axis 1.4-19 (source all) (tony mancill)
[2013-04-09] Accepted axis 1.4-18 (source all) (Emmanuel Bourg) (signed by: tony mancill)

1
2

bugs [bug history graph]

all: 2
RC: 1
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4-30
2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing