CVE-2026-73632

CVE-2026-73632 is a vulnerability in Apache Struts 7.2.1 involving exposure of per-response serialization state in the JSON plugin (SMD/JSON-RPC handling). The issue could allow data observed in one request to become observable in another due to shared serialization state across concurrent reques...

PT-2026-72883

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...