CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Apache Struts can amplify responses when rendering BigDecimal parameters, tracked as CVE-2026-104712.
Lukasz Lenart disclosed CVE-2026-104712, a moderate-severity asymmetric resource-consumption flaw in Apache Struts. When a request parameter is bound to a java.math.BigDecimal property and rendered through the Struts tag library, the framework can return a disproportionately large response. Affected versions are 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The oss-security post does not report exploitation in the wild.
- CVE-2026-104712 is rated moderate asymmetric resource consumption.
- Rendering a bound BigDecimal parameter can greatly enlarge the response.
- Affected builds include Struts 2.5.14–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0.
- CVEs
- CVE-2026-104712
- Vendors
- Apache
- Products
- Apache Struts
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104712 | Response amplification DoS in Apache Struts BigDecimal rendering | 7.5 | — |
From the original article
Posted by Lukasz Lenart on Oct 05 Severity: moderate Affected versions: - Apache Struts 2. 5. 14 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.