CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin
Apache Struts REST plugin reads request bodies without a size limit, enabling memory-exhaustion denial of service.
Lukasz Lenart disclosed CVE-2026-104713, an important-severity flaw in the Apache Struts REST plugin. Affected versions are Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The plugin reads a request body into memory with no size bound, so a single request can make the server allocate excessive memory. The advisory does not state that exploitation has been observed.
- CVE-2026-104713 is an unbounded request-body read in the Struts REST plugin.
- Apache rates it important; one request can force large memory allocation.
- Affected ranges cover Struts 2.1.8–2.3.37, 2.5.0–2.5.33, 6.0.0–6.11.0, and 7.0.0–7.3.0.
- The disclosure does not report active exploitation.
- CVEs
- CVE-2026-104713
- Vendors
- Apache Software Foundation
- Products
- Apache Struts
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104713 | Unbounded request-body DoS in Apache Struts REST plugin | 6.5 | — |
From the original article
Posted by Lukasz Lenart on Oct 05 Severity: important Affected versions: - Apache Struts 2. 1. 8 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.