Apache Struts2 JSON plugin insecure deserialization report continues
Original title: Continued Apache Struts2 JSON Plugin Insecure Deserialisation
Daniel Owens cites earlier Struts2 JSON denial-of-service write-ups and a naïve proof-of-concept script; this excerpt ends before new details.
On October 28, Daniel Owens posted to Full Disclosure a continuation about insecure JSON deserializers, including the Apache Struts2 JSON plugin. He points to prior notes from October 26, 2025 and March 7, 2026 on array and collection denial of service and unconstrained resource consumption, plus a naïve proof-of-concept script. The available text stops before any new technical findings.
Unconfirmed: The post is truncated here; affected versions, a CVE, and any new exploit details are not shown.
- Posted to Full Disclosure by Daniel Owens on October 28.
- A October 26, 2025 note covered Struts2 array and collection denial of service.
- A March 7, 2026 overview addressed unconstrained JSON deserializer resource use.
- He references a naïve proof-of-concept script from that earlier work.
Impact: insecure JSON deserialization linked to resource exhaustion
| Product | Affected |
|---|---|
| Apache Struts2 JSON Plugin | — |
- Vendors
- Apache
- Products
- Struts2 JSON Plugin
From the original article
Posted by Daniel Owens via Fulldisclosure on Oct 28 Summary Thus far we have written extensively about the rampant number of insecure JavaScript Object Notation (JSON) deserialisers available today, like in "Struts2 and Related Framework Array/Collection DoS" (26 October 2025) and "JSON Deserialiser Unconstrained Resource Consumption Quick Overview" (07 March 2026), along with a naïve proof of concept script that…
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.