Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031329 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrar...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031328 advisory. ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site...

Apache Struts 6.x < 6.11.0 / 7.x < 7.3.0 Multiple Vulnerabilities (S2-072) (S2-074)

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by multiple denial of service vulnerabilities, as referenced in the S2-072 and S2-074 advisories: - When an application is configured to populate actions from a...

Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by a denial of service vulnerability as referenced in the S2-073 advisory. - Struts provides an optional facility for collecting Content Security Policy violatio...

Apache Struts < 7.3.0 Multiple Vulnerabilities (S2-070) (S2-071)

The version of Apache Struts installed on the remote host is 7.2.1. It is, therefore, affected by multiple vulnerabilities in the JSON plugin, as referenced in the S2-070 and S2-071 advisories: - A component of the JSON plugin that holds per-request parsing state could be shared between concurren...

Exploit for CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...

CVE-2026-73635

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73634

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

EUVD-2026-59606

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632

Apache Struts 7.2.1's JSON plugin shares per-response serialization state across concurrent requests, letting one user observe another's response content. Only the SMD/JSON-RPC interceptor path is affected; it is disabled by default. No in-the-wild exploitation is reported. Upgrade to 7.3.0. See ...

EUVD-2026-59605

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73631

Apache Struts 7.2.1's JSON plugin shares per-request parsing state across concurrent requests, allowing one user's JSON-parsed data to leak into another's session and bypassing configured parsing limits. Affected deployments are those using JSON request body population. Upgrade to Struts 7.3.0. N...

CVE-2026-73631 Apache Struts: Shared parsing state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

EUVD-2026-59604

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73635 Apache Struts: Unbounded growth of localized-text caches driven by the request locale

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73635

Apache Struts (versions 2.0.0–2.3.37, 2.5.0–2.5.33, 6.0.0–6.10.0, 7.0.0–7.2.1) is vulnerable to unbounded localized-text cache growth: when no fixed locale is set, the request-supplied locale causes caches to expand without limit, exhausting the Java heap and causing denial of service. CVSS 7.5 (...

EUVD-2026-59603

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...