CVE-2026-104712

Apache Struts has an asymmetric resource-consumption flaw (CWE-405) that can amplify a small request into a response many orders of magnitude larger. An unauthenticated remote attacker triggers it when a request parameter is bound to a java.math.BigDecimal property and that property is then rendered through the Struts tag library, exhausting server CPU and outbound network capacity with sustained low-volume traffic. Applications that never bind request parameters to BigDecimal, or never render such a property via the Struts tag library, are not affected. Affected releases are Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0; 6.12.0 and 7.4.0 fix the issue. No public proof of concept is known, the CVE is not on CISA KEV, and exploitation in the wild is not known.

What to do: Upgrade Apache Struts to 6.12.0 or 7.4.0. The advisory does not list a fixed 2.5.x release, so installations on 2.5.14 through 2.5.33 should move to one of those fixed lines. Until then, identify actions that bind request parameters to java.math.BigDecimal and render them with the Struts tag library, and restrict or front those endpoints with rate limits and response-size controls.