CVE-2026-73634: Apache Struts: Unbounded read of a Content Security Policy violation report
Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected.
This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.11.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 7.3.0 - Compensating control
Because the CSP violation-reporting endpoint is ordinarily reachable without authentication, restrict network access to the endpoint so it is not broadly reachable if not required.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73634?
CVE-2026-73634 has a risk rating of 28, indicating a moderate severity vulnerability.
How do I fix CVE-2026-73634?
To mitigate CVE-2026-73634, configure your Apache Struts application to limit the size of incoming Content Security Policy violation reports.
What impact does CVE-2026-73634 have on my application?
CVE-2026-73634 can lead to uncontrolled resource consumption, potentially exhausting heap memory and causing denial of service.
Which versions of Apache Struts are affected by CVE-2026-73634?
CVE-2026-73634 affects all versions of Apache Struts that expose endpoints for collecting Content Security Policy violation reports without proper size limitations.
What types of applications are at risk from CVE-2026-73634?
Applications that utilize Apache Struts and collect Content Security Policy violation reports are at risk from CVE-2026-73634.