Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by a denial of service vulnerability as referenced in the S2-073 advisory. - Struts provides an optional facility for collecting Content Security Policy violatio...

Exploit for CVE-2026-73633

CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...

com.amazonaws.serverless:aws-serverless-java-container-struts (>=1.9, <=1.9.5), com.jgeppert.struts2.bootstrap:struts2-bootstrap-plugin (>=4.0.2, <=5.0.6) +79 more potentially affected by CVE-2026-73634 via org.apache.struts:struts2-core (>=6.0.0, <=6.10.0)

org.apache.struts:struts2-core MAVEN version =6.0.0, =1.9, =4.0.2, =4.0.2, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =1.4.0, =1.4.1, =1.4.0, =1.4.3 and more Source cves: CVE-2026-73634 Source advisory: SNYK:JAVA-OR...

Allocation of Resources Without Limits or Throttling

Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the endpoint that collects Content Security...

com.jgeppert.struts2.bootstrap:struts2-bootstrap-showcase (>=6.0.0, <=6.1.0), com.jgeppert.struts2.jquery:struts2-jquery-grid-showcase (>=6.0.0, <=6.1.0) +4 more potentially affected by CVE-2026-73632 via org.apache.struts:struts2-json-plugin (>=7.0.0, <=7.2.1)

org.apache.struts:struts2-json-plugin MAVEN version =7.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =7.0.0, =7.0.0, =7.2.1 Source cves: CVE-2026-73632 Source advisory: SNYK:JAVA-ORGAPACHESTRUTS-19350835...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73634

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...

CVE-2026-73635

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73635

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73634

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

EUVD-2026-59606

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632

Apache Struts version 7.2.1 is vulnerable to a data exposure flaw in the JSON plugin due to unsynchronized access to shared data in a multithreaded context. Specifically, the per-response serialization state for SMD / JSON-RPC handling could be shared across concurrent requests, potentially allow...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73631 Apache Struts: Shared parsing state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...