CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713

The Apache Struts framework is vulnerable to an allocation of resources without limits or throttling (CWE-770) within the REST plugin . The root cause is that a request body is read into memory without any size bounds, allowing a single request to exhaust the Java heap and cause a denial of servi...

EUVD-2026-92624

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

EUVD-2026-92623

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712

An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts (versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0). The flaw occurs when a request parameter is bound to a java.math.BigDecimal property and subsequently rendered via the Struts t...

CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104711

Apache Struts is vulnerable to Expression Language Injection (CWE-917) when configured to use the legacy RESTful action mapper . A remote attacker can submit a crafted request to inject an OGNL expression , potentially leading to remote code execution on the host server. This vulnerability affect...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

EUVD-2026-92622

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

Apache Struts2 S2-053 OGNL RCE (CVE-2017-12611)

Exploits CVE-2017-12611 S2-053 in Apache Struts 2 via Freemarker tag OGNL injection in the name parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-053 Freemarker OGNL RCE CVE-2017-12611.""" import re import urllib.parse from kittysploit import from...

Apache Struts2 S2-061 RCE (CVE-2020-17530)

Exploits CVE-2020-17530 S2-061 in Apache Struts 2.0.0–2.5.25: forced OGNL evaluation in tag attributes yields remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-061 forced OGNL RCE CVE-2020-17530.""" import re import urllib.parse from kittysploit import from...

CVE-2026-104714: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served request...

CVE-2026-104712: Asymmetric Resource Consumption (Amplification)

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

PT-2026-106134

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An asymmetric resource consumption amplification issue exists when a request parameter is bound to ...