Apache Struts 2.5.14 <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-076)

The version of Apache Struts installed on the remote host is 2.5.14 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced in the S2-076 advisory: - Asymmetric resource consumption amplification vulnerability i...

Linux Distros Unpatched Vulnerability : CVE-2026-104712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal...

CVE-2026-104712

Apache Struts can produce a response many orders of magnitude larger than the request when an attacker-controlled request parameter is bound to a java.math.BigDecimal property and that property is rendered through the Struts tag library. An unauthenticated remote attacker can use sustained,...

EUVD-2026-92623

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712: Asymmetric Resource Consumption (Amplification)

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

PT-2026-106134

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An asymmetric resource consumption amplification issue exists when a request parameter is bound to ...

Cross-site Scripting (XSS)

Overview com.liferay:com.liferay.asset.taglib is a portal for Liferay. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the assetTagNames parameter. An authenticated attacker can execute arbitrary JavaScript in the context of a user's browser by crafting a maliciou...

SUSE CVE-2023-47466

TagLib before 2.0 allows a segmentation violation and application crash during tag writing via a crafted WAV file in which an id3 chunk is the only valid chunk...

SUSE CVE-2010-2937

The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service application crash via a crafted media file...

CVE-2020-29242

dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame...

CVE-2020-29245

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData...

CVE-2020-29243

dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame...

RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2016:1840)

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 and Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

ALPINE-CVE-2018-11439

The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file...

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

It was found that the Java Standard Tag Library JSTL allowed the processing of untrusted XML documents to utilize external entity references, which could access resources on the host system and, potentially, allowing arbitrary code execution...

Critical: Red Hat Security Advisory: Red Hat JBoss SOA Platform security update

An update is now available for Red Hat JBoss SOA Platform 5.3.1. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...