Apache Struts2 JSON Plugin Object Deserialization Limit Bypass
Original title: Apache Struts2 JSON Plugin Insecure Deserialisation -- Object Deserialisation Element-Count Limit Bypass
Bypass targets element-count limit in object deserialization for versions 7.4.0 and 7.5.0 snapshot.
The Apache Struts2 JSON Plugin allows bypassing the object deserialization element-count limit added in WW-5618 and S2-072. Attackers can use a different attack string than previously reported. The issue persists in current versions including 7.4.0 and the 7.5.0 snapshot dated 28 October 2026.
Unconfirmed: Exploitation status and real-world impact unknown; versions as stated.
- Bypass targets object deserialization element-count limit
- Affects versions 7.4.0 and 7.5.0 snapshot
- Attack string differs from prior bypasses
- Reported via Full Disclosure
- No CVE mentioned
Impact: Object deserialization bypass allowing arbitrary element counts
- Vendors
- Apache
- Products
- Struts2 JSON Plugin
From the original article
Posted by Daniel Owens via Fulldisclosure on Nov 01 As of the current versions of the Apache Struts2 JSON Plugin (e. g. , version 7.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.