Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks
Apache discloses four Struts flaws, including OGNL injection that can enable remote code execution.
66
CVE-2026-104713
Unbounded request-body DoS in Apache Struts REST plugin
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Struts has an allocation-of-resources-without-limits flaw (CWE-770) in its REST plugin. The plugin reads an HTTP request body into memory with no bound on size, so a single request can force the server to allocate heap in proportion to that body, exhaust the Java heap, and deny service to other users. No extra setting has to be turned on; any application using the REST plugin on an affected release is exposed, and applications that do not use the plugin are not. Affected ranges are Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. There is no known public proof of concept, the issue is not in CISA KEV, and CVSS has not yet been scored.
What to do: Upgrade Apache Struts to 6.12.0 or 7.4.0. The listed 2.1, 2.3, and 2.5 ranges have no fixed release in the advisory, so those installs should move to 6.12.0 or 7.4.0. Confirm the REST plugin is actually in use; apps that do not use it are not affected. Until you upgrade, cap HTTP request-body size at the reverse proxy or servlet container so one request cannot exhaust the Java heap.
| Product | Affected |
|---|---|
| Apache Struts | 2.1.8 through 2.3.37 |
| Apache Struts | 2.5.0 through 2.5.33 |
| Apache Struts | 6.0.0 through 6.11.0 |
| Apache Struts | 7.0.0 through 7.3.0 |
Estimated exposure
moderatelow tens of thousands of applications (REST-plugin subset of Struts deployments; exact count unknown) — Apache Struts is a long-standing enterprise Java web framework with historically thousands to tens of thousands of internet-facing installs in public scans, but only apps that include the optional REST plugin are affected and no current…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
In the news
3 storiesApache Struts Vulnerabilities Enable Remote Code Execution, DoS and Data Disclosure
Four Apache Struts flaws can enable remote code execution, denial of service, or cross-user data disclosure.
66
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin
Apache Struts REST plugin reads request bodies without a size limit, enabling memory-exhaustion denial of service.
58