CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Apache Struts CVE-2026-104714 is a moderate race that can leak formatted dates across requests.
Lukasz Lenart disclosed CVE-2026-104714, a moderate race condition in Apache Struts caused by a shared message formatter that is not properly synchronized. When a localized message formats a date or time argument, values can be exposed across concurrent requests. Affected versions are 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. The report does not describe in-the-wild exploitation.
- Shared localized date and time formatter lacks proper synchronization.
- Concurrent requests can expose another request's formatted date or time.
- Affected ranges span Struts 2.0.0-2.3.37, 2.5.0-2.5.33, 6.0.0-6.11.0, and 7.0.0-7.3.0.
- Apache rates the issue moderate; exploitation is not reported.
- CVEs
- CVE-2026-104714
- Vendors
- Apache
- Products
- Apache Struts
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104714 | Race condition in Apache Struts leaks dates across users | 8.8 | — |
From the original article
Posted by Lukasz Lenart on Oct 05 Severity: moderate Affected versions: - Apache Struts 2. 0. 0 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.