Apache Struts Patches Four Flaws Including OGNL Injection

Apache fixed four Struts flaws that can enable remote code execution, denial of service, or cross-user data disclosure.

Apache has disclosed four Apache Struts vulnerabilities, CVE-2026-104711 through CVE-2026-104714, that can lead to remote code execution, denial of service, or unintended data disclosure depending on configuration. CVE-2026-104711 is OGNL injection in the legacy RESTful action mapper that may allow remote code execution; GBHackers says default and REST-plugin mappers are unaffected and that Struts 7 is exposed only if the OGNL allowlist is disabled, while Cyber Security News states code execution is possible when that mapper is used. CVE-2026-104712 can amplify responses through BigDecimal rendering and exhaust CPU and bandwidth, CVE-2026-104713 lets oversized or unbounded REST request bodies exhaust heap memory, and CVE-2026-104714 can mix one user's formatted date or time values into another user's response via shared date formatters. Fixes are in Struts 7.4.0 and 6.12.0, with Cyber Security News describing those releases or later. Cyber Security News rates three issues Moderate and the REST body issue Important, while GBHackers specifically calls CVE-2026-104711 moderate; neither report describes active exploitation.