CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.
This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.12.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 7.4.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
An application is affected only if it binds a request parameter to a java.math.BigDecimal property and subsequently renders that property using the Struts tag library. Applications that do not use that binding pattern, or do not render the property through Struts tags, are not affected.
What does an attacker need to exploit it?
An unauthenticated remote attacker needs to send requests that reach a vulnerable parameter-binding and rendering path. Sustained low-volume traffic can cause disproportionate CPU and outbound network consumption because the rendered response can be many orders of magnitude larger than the request.
Are default Struts deployments necessarily vulnerable?
No. Exploitability depends on application-specific use of request binding to BigDecimal properties followed by rendering through the Struts tag library, rather than on Struts being present alone.
How can I determine whether my application is affected?
Review request-handling paths for parameters bound to java.math.BigDecimal properties, then determine whether those properties are rendered with Struts tag-library components. Also identify deployments running Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, or 7.0.0 through 7.3.0.
What versions address the issue?
Upgrade to Apache Struts 6.12.0 or 7.4.0. These versions fix the issue.