https://seclists.org/oss-sec/2026/q4/50: CVE-2026-104712: Apache Struts: Disproportionate sponse size when ndering BigDecimal quest parameters

Q: Which applications are actually exposed to this issue?

An application is affected only if it binds a request parameter to a java.math.BigDecimal property and then renders that property through the Struts tag library. Applications that do not use BigDecimal request-parameter binding, or do not render the bound property through Struts tags, are not affected.

Q: Does exploitation require authentication or high request volume?

No authentication is required. An attacker can use sustained low-volume traffic to trigger disproportionately large responses and exhaust CPU and outbound network capacity.

Q: What versions should be used to remediate the issue?

Upgrade to Apache Struts 6.12.0 or 7.4.0. The affected release ranges are 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.

Published Oct 5, 2026

Updated

Affected Software

1 affected component

Apache Struts>=2.5.14<=2.5.33, >=6.0.0<=6.11.0, >=7.0.0<=7.3.0

Frequently Asked Questions

Which applications are actually exposed to this issue?

An application is affected only if it binds a request parameter to a java.math.BigDecimal property and then renders that property through the Struts tag library. Applications that do not use BigDecimal request-parameter binding, or do not render the bound property through Struts tags, are not affected.

Does exploitation require authentication or high request volume?

No authentication is required. An attacker can use sustained low-volume traffic to trigger disproportionately large responses and exhaust CPU and outbound network capacity.

What versions should be used to remediate the issue?

Upgrade to Apache Struts 6.12.0 or 7.4.0. The affected release ranges are 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.