CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.12.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 7.4.0
Event History
Frequently Asked Questions
Which applications are exposed to cross-request value disclosure or rendering failures?
Affected Apache Struts versions are exposed only when localized messages format date or time arguments. Applications whose localized messages do not format date or time arguments are not affected.
What conditions are required for exploitation?
The issue requires concurrent requests to cause reuse of a formatter retained by the application-wide text provider. Under those conditions, a date or time value from one user's request can appear in another user's response, or message rendering can fail with a server error.
Which versions should be upgraded?
The affected ranges are 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Upgrade to 6.12.0 or 7.4.0, as applicable.