Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.
This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity: moderate
Affected versions:
- Apache Struts 2.0.0 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0
Description:
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Credit:
n0mi1k (finder)
References:
https://cwiki.apache.org/confluence/display/WW/S2-078 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104714
Severity: important
Affected versions:
- Apache Struts 2.1.8 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0
Description:
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Credit:
n0mi1k (finder)
References:
https://cwiki.apache.org/confluence/display/WW/S2-077 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104713
Severity: moderate
Affected versions:
- Apache Struts 2.5.14 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0
Description:
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.
This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Credit:
0xCc.zhang (finder)
References:
https://cwiki.apache.org/confluence/display/WW/S2-076 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104712
Severity: moderate
Affected versions:
- Apache Struts 2.0.0 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0
Description:
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Credit:
LeaveSong (finder)
References:
https://cwiki.apache.org/confluence/display/WW/S2-075 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104711
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.
This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected.
This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
So there is a thing or two that the IT industry can learn from software projects like OpenBSD.
OpenBSD has been advocating for this for years now :-)
On Mon, 12 Jan 2026 at 18:58, Hanno Böck <hanno () hboeck de> wrote: Looking through recent mails on this list with XXE in the toppic, I see:
XXE in Apache Struts due to insecure defaults in Java's standard library: CVE-2025-68493 XXE in Apache SIS due to insecure defaults in Java's standard library: CVE-2025-68280 XXE in Apache Tika due to insecure defaults in Java's standard library: CVE-2025-54988, CVE-2025-66516 XXE in Apache Jackrabbit due to insecure defaults in Java's standard library: CVE-2025-53689 XXE in Apache Ambari due to insecure defaults in Java's standard library: CVE-2025-23195 XXE in Apache XML Graphics FOP due to insecure defaults in Java's standard library: CVE-2024-28168 XXE in Apache Drill due to insecure defaults in Java's standard library: CVE-2023-48362
Also recently: my research on prevalent XXEs in electronic invoicing software, largely due to insecure defaults in Java and Saxon (which is based on Java): https://invoice.secvuln.info/
I'm sensing a pattern here. Maybe Apache should audit all their uses of Apache's XML standard library. And, maybe, having insecure defaults in Java's standard library is not so great.
-- Hanno Böck - Independent security researcher https://itsec.hboeck.de/ https://badkeys.info/
Looking through recent mails on this list with XXE in the toppic, I see:
XXE in Apache Struts due to insecure defaults in Java's standard library: CVE-2025-68493 XXE in Apache SIS due to insecure defaults in Java's standard library: CVE-2025-68280 XXE in Apache Tika due to insecure defaults in Java's standard library: CVE-2025-54988, CVE-2025-66516 XXE in Apache Jackrabbit due to insecure defaults in Java's standard library: CVE-2025-53689 XXE in Apache Ambari due to insecure defaults in Java's standard library: CVE-2025-23195 XXE in Apache XML Graphics FOP due to insecure defaults in Java's standard library: CVE-2024-28168 XXE in Apache Drill due to insecure defaults in Java's standard library: CVE-2023-48362
Also recently: my research on prevalent XXEs in electronic invoicing software, largely due to insecure defaults in Java and Saxon (which is based on Java): https://invoice.secvuln.info/
I'm sensing a pattern here. Maybe Apache should audit all their uses of Apache's XML standard library. And, maybe, having insecure defaults in Java's standard library is not so great.
-- Hanno Böck - Independent security researcher https://itsec.hboeck.de/ https://badkeys.info/
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
Severity: important
Affected versions:
- Apache Struts (com.opensymphony:xwork) 2.0.0 before 2.2.1 - Apache Struts (org.apache.struts.xwork:xwork-core) 2.2.1 through 6.1.0
Description:
Missing XML Validation vulnerability in Apache Struts, Apache Struts.
This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.
Users are recommended to upgrade to version 6.1.1, which fixes the issue.
References:
https://cwiki.apache.org/confluence/display/WW/S2-069 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-68493
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Severity: important
Affected versions: - Apache Struts (org.apache.struts:struts2-core) 2.0.0 through 6.7. - Apache Struts (org.apache.struts:struts2-core) 7.0.0 through 7.0.
Description: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
Credit: Nicolas Fournier (reporter)
References: https://cwiki.apache.org/confluence/display/WW/S2-068 https://cve.org/CVERecord?id=CVE-2025-64775 https://cve.org/CVERecord?id=CVE-2025-66675 https://struts.apache.org/
Kind regards Łukasz
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.
This issue affects Apache Struts: from 2.0.0 before 6.4.0.
Users are recommended to upgrade to version 6.4.0 at least and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . If you are not using an old file upload logic based on FileuploadInterceptor your application is safe.
You can find more details in https://cwiki.apache.org/confluence/display/WW/S2-067
An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.
Workspace ONE Launcher contains a Privilege Escalation Vulnerability. A malicious actor with physical access to Workspace ONE Launcher could utilize the Edge Panel feature to bypass setup to gain access to sensitive information.
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Windows MSHTML Platform Remote Code Execution Vulnerability
Microsoft Power Platform Connector Spoofing Vulnerability
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.