{"id":"UBUNTU-CVE-2026-90436","details":"** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP \u003cFault\u003e carries a \u003cdetail\u003e\u003cexceptionName\u003e element, Axis loads the named class and, if a String \u003cdata\u003e element is also present, instantiates it through its String constructor before checking that it is an AxisFault. Loading alone runs the class's static initializer. With a suitable class on the application's classpath this leads to remote code execution. The fault is parsed while the engine resolves the target service, before any per-service handler chain runs, so authentication handlers configured on a service do not protect against it. This affects all Apache Axis 1.x versions through 1.4. As Axis 1 has been EOL we recommend you migrate to a different SOAP engine, such as Apache Axis 2/Java. Alternatively you could use a build of Axis with the patch from https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd applied. The Apache Axis project does not expect to create an Axis 1.x release fixing this problem.","modified":"2026-11-10T02:52:13.868387659Z","published":"2026-11-09T00:00:00Z","upstream":["CVE-2026-90436"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-90436"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-90436"},{"type":"REPORT","url":"https://lists.apache.org/thread/8slf0j9gz35z56t0glt5h0ncwlbn4bdz"},{"type":"REPORT","url":"https://github.com/apache/axis-axis1-java/commit/41f3b4e8d04e310ca81f86b92630ab2c11d608bd"},{"type":"REPORT","url":"https://lists.apache.org/thread.html/8slf0j9gz35z56t0glt5h0ncwlbn4bdz"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2026/11/06/12"}],"affected":[{"package":{"name":"axis","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/axis?arch=source&distro=esm-apps%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-22","1.4-23","1.4-24","1.4-24ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4-24ubuntu0.1~esm1","binary_name":"libaxis-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}},{"package":{"name":"axis","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/axis?arch=source&distro=esm-apps%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-25","1.4-25ubuntu0.1~esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libaxis-java","binary_version":"1.4-25ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}},{"package":{"name":"axis","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/axis?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-28+deb10u1build0.20.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4-28+deb10u1build0.20.04.1","binary_name":"libaxis-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}},{"package":{"name":"axis","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/axis?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-28+deb10u1build0.22.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libaxis-java","binary_version":"1.4-28+deb10u1build0.22.04.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}},{"package":{"name":"axis","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/axis?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-28","1.4-29"],"ecosystem_specific":{"binaries":[{"binary_name":"libaxis-java","binary_version":"1.4-29"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}},{"package":{"name":"axis","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/axis?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-29build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libaxis-java","binary_version":"1.4-29build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}},{"package":{"name":"axis","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/axis?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-29","1.4-29build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4-29build1","binary_name":"libaxis-java"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90436.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}