Apache Struts 2 JSON 7.5.0 maxElements Denial of Service

Apache Struts 2 JSON versions 7.4.0 and the 7.5.0 snapshot contain a maxElements limit bypass in object parsing. Repeated JSON keys do not increase the HashMap size, allowing excessive parsing and allocation work that may cause denial of service...