Apache Struts Vulnerabilities Enable Remote Code Execution, DoS and Data Disclosure
Four Apache Struts flaws can enable remote code execution, denial of service, or cross-user data disclosure.
Four Apache Struts flaws, CVE-2026-104711 through CVE-2026-104714, are fixed in versions 7.4.0 and 6.12.0. CVE-2026-104711 is OGNL injection in the legacy RESTful action mapper that can allow remote code execution; default and REST-plugin mappers are unaffected, and Struts 7 is exposed only if the OGNL allowlist is disabled. CVE-2026-104712 can turn BigDecimal rendering into CPU and bandwidth exhaustion, CVE-2026-104713 allows an oversized REST body to exhaust heap memory, and CVE-2026-104714 can mix one user's formatted date or time values into another user's response. Exposure depends on configuration, and the report does not describe active exploitation.
- Fixes are available in Struts 7.4.0 and 6.12.0
- CVE-2026-104711 is moderate OGNL injection with possible remote code execution
- CVE-2026-104712 can exhaust CPU and bandwidth via BigDecimal rendering
- CVE-2026-104713 lets oversized REST bodies exhaust heap memory
- CVE-2026-104714 can disclose another user's formatted date or time values
- Vendors
- Apache
- Products
- Apache Struts
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-104711+3 related CVEs | OGNL injection in Apache Struts legacy REST mapper | 9.8 group max | 1% | PoC ×2 |
From the original article
2 min read at gbhackers.com
Four Apache Struts vulnerabilities outlined in recent advisories expose affected applications to risks such as remote code execution, denial of service, and cross-user data disclosure. These issues impact legacy action mapping, decimal rendering, REST request processing, and localized message formatting. Fixes are available in Struts versions 7.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.