CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

EUVD-2026-92624

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

EUVD-2026-92623

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712

An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts (versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0). The flaw occurs when a request parameter is bound to a java.math.BigDecimal property and subsequently rendered via the Struts t...

CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

EUVD-2026-92622

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104711 Apache Struts: OGNL injection in the legacy RESTful action mapper

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2026-104711

Apache Struts is vulnerable to Expression Language Injection (CWE-917) when configured to use the legacy RESTful action mapper . A remote attacker can submit a crafted request to inject an OGNL expression , potentially leading to remote code execution on the host server. This vulnerability affect...

struts1filter

struts1filter Una solución de filtro de parámetros de solicitud para Apache Struts 1 CVE-2014-0114 basada en el trabajo de Alvaro Munoz y el equipo de HP Fortify. Para usar este filtro, añade la siguiente declaración de filtro junto con el mapeo apropiado al descriptor web.xml de la aplicación...

CVE-2017-5638

CVE-2017-5638 | Struts s2-045 Descripción Es posible realizar un ataque RCE con un valor malicioso de Content-Type. Si el valor de Content-Type no es válido, se lanza una excepción que luego se utiliza para mostrar un mensaje de error a un usuario. Versiones afectadas Struts 2.3.5 Struts 2.3.31...

CVE-2018-11776

CVE-2018-11776 Prueba de concepto de exploit para evaluar rápidamente qué tipos de protecciones y correcciones están disponibles. Descubierto originalmente por Man Yue Mo, Semmle: https://semmle.com/news/apache-struts-CVE-2018-11776 Semmle tuvo un video de YouTube "Apache Struts RCE -...

CVE-2017-5638

CVE-2017-5638 Vulnerabilidad RCE en Apache Struts 2.0 Este es un script para explotar CVE-2017-5638 - Permite a un atacante inyectar comandos del sistema operativo en una aplicación web a través del encabezado content-type Apache Struts 2 es un framework de aplicaciones web de código abierto para...

-CVE-2017-9805

Información de vulnerabilidad Recursos: https://vulners.com/cve/CVE-2017-9805 ¿Qué es esto? Un script de exploit en Python capaz de ejecutar comandos remotos en el shell de un sistema que aloja un Struts2 vulnerable a S2-052. Uso ╭─root@blackshell / ╰─ python s2-052.py --target...

Apache-Struts-Shodan-Exploit

POC DE EXPLOTACIÓN DE APACHE STRUTS SHODAN Autor: @037 El código original se puede encontrar aquí. Esta herramienta aprovecha CVE-2018-11776 y Shodan para realizar explotación masiva de servidores Apache Struts verificados y vulnerables. El parámetro de búsqueda de Shodan se ha omitido para...

docker-lab-cve-2017-5638-cve-2021-41773

Laboratorio de Atacante: CVE-2017-5638 & CVE-2021-41773 Un laboratorio de emulación de ataques basado en Docker con 7 hosts, diseñado para demostrar una cadena de eliminación de múltiples etapas, movimiento lateral y detección de IDS multipunto. Resumen Este laboratorio simula un entorno de red...

apache-struts-cve-2017-9805

El framework web Apache Struts El framework web Apache Struts es una solución gratuita de código abierto para crear aplicaciones web Java. Las aplicaciones web se diferencian de los sitios web convencionales en que las aplicaciones web pueden crear una respuesta dinámica. Muchos sitios web entreg...

CVE-2023-50164-PoC

CVE-2023-50164 PoC This repository is a proof of concept PoC of the CVE-2023-50164 vulnerability. 1. About CVE-2023-50164 CVE-2023-50164 is a file path traversal vulnerability that occurs in Apache Struts web application. An attacker could exploit this vulnerability to upload malicious file...