CVE-2026-73633: Apache Struts: Unbounded read of a JSON request body
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.11.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 7.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73633?
CVE-2026-73633 has a risk rating of 26, indicating a significant potential for harm.
How do I fix CVE-2026-73633?
To mitigate CVE-2026-73633, configure the JSON plugin to limit the size of the request body processed.
What systems are affected by CVE-2026-73633?
CVE-2026-73633 affects applications using Apache Struts with the JSON plugin enabled.
What type of vulnerability is CVE-2026-73633?
CVE-2026-73633 is classified as an uncontrolled resource consumption vulnerability.
Can CVE-2026-73633 lead to denial of service?
Yes, CVE-2026-73633 can lead to denial of service by exhausting application memory.