https://seclists.org/oss-sec/2026/q4/52: CVE-2026-104714: Apache Struts: Shad message formatter exposes date and time values across concurnt quests

Q: Which applications are actually exposed to this issue?

Only applications with localized messages that format date or time arguments are affected. Applications whose localized messages do not format date or time arguments are not affected.

Q: What conditions are needed for exploitation?

The issue occurs when requests are served concurrently and use a retained formatter for the same localized message. Under those conditions, a date or time value from one user's request can appear in another user's response, or rendering can fail with a server error.

Q: What should teams do to remediate the issue?

Upgrade to Apache Struts 6.12.0 or 7.4.0, which fix the issue. The affected release ranges include Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.

Published Oct 5, 2026

Updated

Affected Software

1 affected component

Apache Struts>=2.0.0<=2.3.37, >=2.5.0<=2.5.33, >=6.0.0<=6.11.0, >=7.0.0<=7.3.0

Frequently Asked Questions

Which applications are actually exposed to this issue?

Only applications with localized messages that format date or time arguments are affected. Applications whose localized messages do not format date or time arguments are not affected.

What conditions are needed for exploitation?

The issue occurs when requests are served concurrently and use a retained formatter for the same localized message. Under those conditions, a date or time value from one user's request can appear in another user's response, or rendering can fail with a server error.

What should teams do to remediate the issue?

Upgrade to Apache Struts 6.12.0 or 7.4.0, which fix the issue. The affected release ranges include Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.