Apache Struts Patches Four Flaws Including OGNL Injection

Four Apache Struts flaws can enable code execution, denial of service, or cross-user date disclosure; fixes are in 6.12.0 and 7.4.0.

Lukasz Lenart disclosed four Apache Struts vulnerabilities on oss-security on 2026-10-05: CVE-2026-104711 through CVE-2026-104714. CVE-2026-104711 is a moderate OGNL injection in the legacy RESTful action mapper affecting 2.0.0-2.3.37, 2.5.0-2.5.33, 6.0.0-6.11.0, and 7.0.0-7.3.0; later reports say it can allow remote code execution only when that mapper is used, with default and REST-plugin mappers unaffected and Struts 7 exposed only if the OGNL allowlist is disabled. CVE-2026-104712, rated moderate, affects 2.5.14-2.5.33, 6.0.0-6.11.0, and 7.0.0-7.3.0 and can turn a java.math.BigDecimal parameter rendered by the Struts tag library into a disproportionately large response that GBHackers describes as CPU and bandwidth exhaustion. CVE-2026-104713, rated important, is an unbounded REST-plugin request-body read affecting 2.1.8-2.3.37, 2.5.0-2.5.33, 6.0.0-6.11.0, and 7.0.0-7.3.0 that can exhaust heap memory from a single request. CVE-2026-104714, rated moderate, is a shared unsynchronized message-formatter race on ranges 2.0.0-2.3.37, 2.5.0-2.5.33, 6.0.0-6.11.0, and 7.0.0-7.3.0 that can expose one user's formatted date or time in another user's response. GBHackers and Cyber Security News say fixes are Struts 7.4.0 or later and 6.12.0 or later, and no source reports exploitation; the Cyber Security News headline calls the set critical, which disagrees with the Moderate and Important ratings in the advisories and in that article's body, and the original oss-security posts did not explicitly state remote code execution for CVE-2026-104711.