CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
oss-sec: CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Posted by Robert Lazarski on Nov 06 Severity: important
Affected versions:
- Apache Axis2/Java before 2.0.2
Description:
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a
non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to
deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the...
seclists.org
November 6, 2026 at 6:34 PM
CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Building a Nodemailer replyTo as a string, `${name} <${email}>`, breaks on form input. Its address parser reads ":" as the start of a group and "(" as a comment, so a name like "Sales: East (Tokyo)" gets mangled. Passing { name, address } skips the parser.
November 5, 2026 at 11:13 AM
Building a Nodemailer replyTo as a string, `${name} <${email}>`, breaks on form input. Its address parser reads ":" as the start of a group and "(" as a comment, so a name like "Sales: East (Tokyo)" gets mangled. Passing { name, address } skips the parser.
🌎 Imagine a world where we celebrate the spiritual wisdom that unites us rather than the differences that divide us. This vision inspired my book, The Gathering of One: The Art of Creating More Peace and Joy in Your Life. Replyto this post or order directly from store.bookbaby.com ❤️
October 24, 2026 at 3:32 PM
🌎 Imagine a world where we celebrate the spiritual wisdom that unites us rather than the differences that divide us. This vision inspired my book, The Gathering of One: The Art of Creating More Peace and Joy in Your Life. Replyto this post or order directly from store.bookbaby.com ❤️
3 messages restored. HTTP 200. The reply lost its parent.
Reload checks passed; real backup → a new SQLite DB erased replyTo on a pinned WA-archiver build.
Synthetic repro + raw screenshots:
github.com/aichance/bus...
Reload checks passed; real backup → a new SQLite DB erased replyTo on a pinned WA-archiver build.
Synthetic repro + raw screenshots:
github.com/aichance/bus...
October 16, 2026 at 2:46 PM
3 messages restored. HTTP 200. The reply lost its parent.
Reload checks passed; real backup → a new SQLite DB erased replyTo on a pinned WA-archiver build.
Synthetic repro + raw screenshots:
github.com/aichance/bus...
Reload checks passed; real backup → a new SQLite DB erased replyTo on a pinned WA-archiver build.
Synthetic repro + raw screenshots:
github.com/aichance/bus...
バックアップは「読めた・件数が合った」で終えない。
固定版を合成データで検証：
①自分で出力したDOCSは復元で拒否
②不正IDは保存できても詳細を開けない
③3件復元・HTTP 200でも返信先が消える
実ファイル往復2例と、不正ID入力1例を分けて比較。再現コード・修正後の同一テスト・保証範囲をまとめました。
解説：https://qiita.com/aichance/items/888e82ad8a6d096f8f53
コード：https://github.com/aichance/business-ai-recipes
aichance（AI運用）
#Playwright
固定版を合成データで検証：
①自分で出力したDOCSは復元で拒否
②不正IDは保存できても詳細を開けない
③3件復元・HTTP 200でも返信先が消える
実ファイル往復2例と、不正ID入力1例を分けて比較。再現コード・修正後の同一テスト・保証範囲をまとめました。
解説：https://qiita.com/aichance/items/888e82ad8a6d096f8f53
コード：https://github.com/aichance/business-ai-recipes
aichance（AI運用）
#Playwright
October 16, 2026 at 9:49 PM
バックアップは「読めた・件数が合った」で終えない。
固定版を合成データで検証：
①自分で出力したDOCSは復元で拒否
②不正IDは保存できても詳細を開けない
③3件復元・HTTP 200でも返信先が消える
実ファイル往復2例と、不正ID入力1例を分けて比較。再現コード・修正後の同一テスト・保証範囲をまとめました。
解説：https://qiita.com/aichance/items/888e82ad8a6d096f8f53
コード：https://github.com/aichance/business-ai-recipes
aichance（AI運用）
#Playwright
固定版を合成データで検証：
①自分で出力したDOCSは復元で拒否
②不正IDは保存できても詳細を開けない
③3件復元・HTTP 200でも返信先が消える
実ファイル往復2例と、不正ID入力1例を分けて比較。再現コード・修正後の同一テスト・保証範囲をまとめました。
解説：https://qiita.com/aichance/items/888e82ad8a6d096f8f53
コード：https://github.com/aichance/business-ai-recipes
aichance（AI運用）
#Playwright
#DearUSA
1. The entire world is not promoting quoting repeating Dr. Bandy X Lee's 27 leaders since year 2017.
2. Year 2017 Doctor Bandy X Lee published a nonfiction important book on paper.
#NoReply #NoReplyAtAll #ReplyAll #FWakeReplyAll #ReplyAtAll
#ReplyTo #ReplyToAll
REPLY ALL : RE: *
1. The entire world is not promoting quoting repeating Dr. Bandy X Lee's 27 leaders since year 2017.
2. Year 2017 Doctor Bandy X Lee published a nonfiction important book on paper.
#NoReply #NoReplyAtAll #ReplyAll #FWakeReplyAll #ReplyAtAll
#ReplyTo #ReplyToAll
REPLY ALL : RE: *
Genesis - No Reply (Official Music Video)
YouTube video by Genesis
www.youtube.com
October 13, 2026 at 8:47 PM
#DearUSA
1. The entire world is not promoting quoting repeating Dr. Bandy X Lee's 27 leaders since year 2017.
2. Year 2017 Doctor Bandy X Lee published a nonfiction important book on paper.
#NoReply #NoReplyAtAll #ReplyAll #FWakeReplyAll #ReplyAtAll
#ReplyTo #ReplyToAll
REPLY ALL : RE: *
1. The entire world is not promoting quoting repeating Dr. Bandy X Lee's 27 leaders since year 2017.
2. Year 2017 Doctor Bandy X Lee published a nonfiction important book on paper.
#NoReply #NoReplyAtAll #ReplyAll #FWakeReplyAll #ReplyAtAll
#ReplyTo #ReplyToAll
REPLY ALL : RE: *
I'm gonna steal that strategy. Definitely got to use the 'ReplyTo' address, but otherwise seems solid :)
September 28, 2026 at 2:15 PM
I'm gonna steal that strategy. Definitely got to use the 'ReplyTo' address, but otherwise seems solid :)
mlmmj 2.2.0 is out!
- new subreleaseall control
- $disarmedfrom$ is now RFC 2047 encoded
- replyto and mlmmj-receive-strip deprecated
- build fixed for GNU make and OpenBSD make
- memory fixes, fr/cs updates
codeberg.org/mlmmj/mlmmj/...
- new subreleaseall control
- $disarmedfrom$ is now RFC 2047 encoded
- replyto and mlmmj-receive-strip deprecated
- build fixed for GNU make and OpenBSD make
- memory fixes, fr/cs updates
codeberg.org/mlmmj/mlmmj/...
[<common-diff-options>] [ <since> | <revision-range> ] DESCRIPTION Prepare each non-merge commit with git merge will.
Refs/tags/ and refs/remotes/ will not be required for this type of the tree structure GIT_INDEX_FILE.
codeberg.org
September 24, 2026 at 4:06 PM
mlmmj 2.2.0 is out!
- new subreleaseall control
- $disarmedfrom$ is now RFC 2047 encoded
- replyto and mlmmj-receive-strip deprecated
- build fixed for GNU make and OpenBSD make
- memory fixes, fr/cs updates
codeberg.org/mlmmj/mlmmj/...
- new subreleaseall control
- $disarmedfrom$ is now RFC 2047 encoded
- replyto and mlmmj-receive-strip deprecated
- build fixed for GNU make and OpenBSD make
- memory fixes, fr/cs updates
codeberg.org/mlmmj/mlmmj/...
Ugh. I got an email from a local business I've patronized where people go to soak in hot tubs.
It appeared to be from the business, but the replyto field was to something at the url getreach.ai, which bills itself as an AI service for your business' front desk […]
[Original post on friend.camp]
It appeared to be from the business, but the replyto field was to something at the url getreach.ai, which bills itself as an AI service for your business' front desk […]
[Original post on friend.camp]
![Hi,
I'm forwarding the below message because it's not the kind of thing I consented to receive over email. It seems like you all are using some kind of AI front desk management service, and it decided on its own (maybe) that I need to know about a single appointment that opened up and that I'm "due for a visit" (I don't even know what that means, I just occasionally enjoy a soak at [BUSINESS]).
I find this kind of thing really disappointing from a beloved local business like [BUSINESS]. Also of note, when I click "unsubscribe", it goes to an insecure URL, which causes my browser to flag it as malware.
Basically: if you are using something called GetReach you should know that it is poorly technically implemented and is also doing things that will probably alienate customers. My career is in IT and my unsolicited professional advice is for you to stop using it. If you aren't using something called GetReach, you should figure out why and how they are spoofing your business.
Thanks,
Darius](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:qmy36tgi4n3ea7n2ti3g54vv/bafkreibjwoi4hodvwbfun2v2dkhg63xg32flh7yv7nn6cvghpugmmssyk4)
![Hi Darius, a [redacted] just opened up for Fri Sep 18. Call us or click Book Now to reserve this appointment.
We know you are due to come see us and thought this time might work for you. If this time doesn't work, we have other options for you over the next few days. Click here to see.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:qmy36tgi4n3ea7n2ti3g54vv/bafkreifehvceais66ehrnml5ecyfre3py5zni5la5jzrrqgpszafybf534)
September 15, 2026 at 5:03 PM
Ugh. I got an email from a local business I've patronized where people go to soak in hot tubs.
It appeared to be from the business, but the replyto field was to something at the url getreach.ai, which bills itself as an AI service for your business' front desk […]
[Original post on friend.camp]
It appeared to be from the business, but the replyto field was to something at the url getreach.ai, which bills itself as an AI service for your business' front desk […]
[Original post on friend.camp]
STOP I CANT EVEN REPLYTO ANYONE WHAT THE FUCK DID DECIMATED DAVE DO
August 29, 2026 at 7:47 AM
STOP I CANT EVEN REPLYTO ANYONE WHAT THE FUCK DID DECIMATED DAVE DO
wrong post to replyto
February 12, 2025 at 11:41 PM
wrong post to replyto
.@LorettaLametta Habe Problem mit nicht nachvollziehb. Replies ohne Replyto-Link bei Followern, die selten tweeten. Dann finde ich Bezug ni.
November 22, 2024 at 8:47 AM
.@LorettaLametta Habe Problem mit nicht nachvollziehb. Replies ohne Replyto-Link bei Followern, die selten tweeten. Dann finde ich Bezug ni.
replyto deflects to /dev/null
July 6, 2025 at 2:10 PM
replyto deflects to /dev/null
🟠 CVE-2026-40999 - High (8.6)
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiat...
https://www.thehackerwire.com/vulnerability/CVE-2026-40999/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiat...
https://www.thehackerwire.com/vulnerability/CVE-2026-40999/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
June 11, 2026 at 10:00 AM
🟠 CVE-2026-40999 - High (8.6)
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiat...
https://www.thehackerwire.com/vulnerability/CVE-2026-40999/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiat...
https://www.thehackerwire.com/vulnerability/CVE-2026-40999/
#infosec #cybersecurity #CVE #vulnerability #security #patchstack
didn't replyto me for a whole hour but immediately noticed my pfp changing :/
May 14, 2025 at 12:55 AM
didn't replyto me for a whole hour but immediately noticed my pfp changing :/
i should replyto my friends msgs its been a few days iv not talking to anyone now
December 13, 2025 at 4:40 PM
i should replyto my friends msgs its been a few days iv not talking to anyone now
ray please replyto me we dont have to go on a gaycation
December 7, 2024 at 4:44 PM
ray please replyto me we dont have to go on a gaycation
i guess i'm not as interested in static legacy data, you could generally just publish those in your own repo and turn any links (.replyTo, etc.) into canonical-ish urls, like `https://x.com/USER_ID/status/TWEET_ID`. then you can use a service like constellation to find references to a url.
November 16, 2025 at 10:59 AM
i guess i'm not as interested in static legacy data, you could generally just publish those in your own repo and turn any links (.replyTo, etc.) into canonical-ish urls, like `https://x.com/USER_ID/status/TWEET_ID`. then you can use a service like constellation to find references to a url.
Email analysis (what do you usually do?)
Email analysis (what do you usually do?)
Hi guys! I'm looking for advice from my fellow blue teamers!
So, when a client asks for an email analysis, what do you usually do?
Normally I:
- check headers
- check replyto
- check spf, dmark, ...
reddit.com
June 8, 2025 at 4:42 AM
Email analysis (what do you usually do?)
Je teste un autre replyTo sur BS.
October 30, 2023 at 11:28 AM
Je teste un autre replyTo sur BS.
Je teste un autre replyTo sur BS.
October 30, 2023 at 11:20 AM
Je teste un autre replyTo sur BS.
Je teste replyTo sur BS.
October 30, 2023 at 11:03 AM
Je teste replyTo sur BS.
