https://seclists.org/oss-sec/2026/q4/51: CVE-2026-104713: Apache Struts: Unbounded quest body ad in the ST plugin

Q: Which deployments are exposed to this denial-of-service issue?

Only Apache Struts applications that use the REST plugin are affected. No additional setting needs to be enabled for the vulnerable request-body handling to occur.

Q: What must an attacker do to trigger the issue?

An attacker can send a request with a sufficiently large body to the REST plugin. The body is read into memory without a size bound, allowing a single request to consume Java heap memory and deny service to other users.

Q: What versions should be used to remediate the issue?

Upgrade to Apache Struts 6.12.0 or 7.4.0. The affected release ranges include 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.

Published Oct 5, 2026

Updated

Affected Software

1 affected component

Apache Struts>=2.1.8<=2.3.37, >=2.5.0<=2.5.33, >=6.0.0<=6.11.0, >=7.0.0<=7.3.0

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Only Apache Struts applications that use the REST plugin are affected. No additional setting needs to be enabled for the vulnerable request-body handling to occur.

What must an attacker do to trigger the issue?

An attacker can send a request with a sufficiently large body to the REST plugin. The body is read into memory without a size bound, allowing a single request to consume Java heap memory and deny service to other users.

What versions should be used to remediate the issue?

Upgrade to Apache Struts 6.12.0 or 7.4.0. The affected release ranges include 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.