Security Bulletin: Multiple Security Vulnerabilities in Apache Struts affect IBM Sterling B2B Integrator (CVE-2026-73634, CVE-2026-73635)

Summary IBM Sterling B2B Integrator has addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-73634 DESCRIPTION: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports...

DoS (Denial of Service) org.apache.struts:struts2-core Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...

Apache Struts 2.1.8 <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.12.0 / 7.x < 7.4.0 Denial of Service (S2-077)

The version of Apache Struts installed on the remote host is 2.1.8 through 2.3.37, or 2.5.0 through 2.5.33, or 6.x prior to 6.12.0, or 7.x prior to 7.4.0. It is, therefore, affected by a denial of service vulnerability, as referenced in the S2-077 advisory: - Allocation of resources without limit...

Linux Distros Unpatched Vulnerability : CVE-2026-107726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of dat...

GHSA-6V25-8WQ6-XQ4J Hazelcast allows arbitrary member memory access by low-privileged client

Impact A flaw has been found in Hazelcast Enterprise Edition and Community Edition, which would allow a low-privileged malicious client to read arbitrary data in memory from any cluster member including Java heap memory, off-heap data, and JVM process address space. Additionally, such a client ma...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726

Hazelcast is vulnerable to an arbitrary memory access flaw in versions prior to 5.4.5, 5.5.10, 5.6.1, and 5.7.0 . The root cause is improper validation of data supplied by a malicious client capable of connecting to a cluster. An attacker can perform arbitrary reads from a cluster member's Java h...

CVE-2026-107726

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

CVE-2026-107726 Hazelcast: Arbitrary member memory access by low-privileged client

Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, an...

PT-2026-108287

Name of the Vulnerable Software and Affected Versions Hazelcast versions prior to 5.4.5 Hazelcast versions prior to 5.5.10 Hazelcast versions prior to 5.6.1 Hazelcast versions prior to 5.7.0 Description Improper validation of data supplied by a malicious client allows arbitrary reads from a clust...

CVE-2026-104713

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713 Apache Struts: Unbounded request body read in the REST plugin

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

EUVD-2026-92624

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap a...

CVE-2026-104713

The Apache Struts framework is vulnerable to an allocation of resources without limits or throttling (CWE-770) within the REST plugin . The root cause is that a request body is read into memory without any size bounds, allowing a single request to exhaust the Java heap and cause a denial of servi...

Uncontrolled Resource Consumption

Apache Struts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded growth of internal localized-text caches based on attacker-controlled locale values from incoming requests, which allows an unauthenticated remote attacker to exhaust the Java heap and cause a...

CVE-2026-73635

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...

CVE-2026-73635: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches...