CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment Principle: It comes from the JSON population of the server-side enabled JSON body plugin "JSON population" is a core feature provided by the JSON plugin in Struts 2, which can be simply understood as an automatic data conversion mechanism...

Apache Struts2 JSON Deserialization Memory Exhaustion / Denial of Service

Apache Struts2's JSON plugin is reportedly susceptible to denial of service attacks through excessive memory allocation during deserialization of deeply nested JSON arrays. Despite the introduction of input length, nesting depth, and element count restrictions in WW-5618 and S2-072, the parser...

Apache Struts2 JSON Deserialization Denial of Service Hardening Bypass

Apache Struts2's JSON plugin is reportedly susceptible to denial of service conditions due to insufficient resource consumption controls during recursive JSON deserialization. Despite the introduction of depth, element count, and input length restrictions through WW-5618 and S2-072, the...

Security Bulletin: A Security Vulnerability in Apache Struts affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-73633)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed this security vulnerability Vulnerability Details CVEID:CVE-2026-73633 DESCRIPTION: Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate...

K000163762: Apache Struts vulnerabilities CVE-2026-73631, CVE-2026-73634, and CVE-2026-73635

Security Advisory Description CVE-2026-73631 Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured...

PT-2026-115910

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

PT-2026-115922

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

PT-2026-115898

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data...

PT-2026-109269

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.27 MariaDB server version 10.11.18 and earlier MariaDB server version 11.4.12 and earlier MariaDB server version 11.8.8 and earlier MariaDB server version 12.3.2 and earlier MariaDB server version...

Exposure Of Data Element To Wrong Session

org.apache.struts, struts2-json-plugin is vulnerable to an exposure of data element to wrong session. The vulnerability is due to per-request JSON parsing state being shared across concurrent requests, which allows an attacker to potentially observe data associated with another request and bypass...

Apache Struts 6.x < 6.11.0 / 7.x < 7.3.0 Multiple Vulnerabilities (S2-072) (S2-074)

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by multiple denial of service vulnerabilities, as referenced in the S2-072 and S2-074 advisories: - When an application is configured to populate actions from a...

Apache Struts < 7.3.0 Multiple Vulnerabilities (S2-070) (S2-071)

The version of Apache Struts installed on the remote host is 7.2.1. It is, therefore, affected by multiple vulnerabilities in the JSON plugin, as referenced in the S2-070 and S2-071 advisories: - A component of the JSON plugin that holds per-request parsing state could be shared between concurren...

Exploit for CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the endpoint that collects Content Security Policy violation reports. An attacker can cause excessive memory consumption and disrupt service availability by submitting a large,...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=4.0.2, <=5.0.6), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=5.0.0, <=5.0.7) +4 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-json-plugin (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-json-plugin MAVEN version =6.0.0, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =6.0.0, =6.0.0, =6.10.0 Source cves: CVE-2026-73634 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19351919...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73634 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19351919...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context in the JSON plugin due to shared parsing state across concurrent requests. An attacker can access data associated with another user's request or bypass configured parsing...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73631 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73631 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19350821...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context in the JSON plugin's SMD/JSON-RPC handling. An attacker can access response content intended for another user's session by making concurrent requests, potentially exposing...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73632 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73632 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19350835...