Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Author says Struts2 JSON plugin still open to comma-array attacks

1 source · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Daniel Owens says Struts2 JSON Plugin fixes through S2-072 still allow maximised comma-array resource consumption; no CVE or confirmed attacks are named.

On October 28, Daniel Owens posted to Full Disclosure that Apache Struts2 JSON Plugin changes through S2-072 still do not stop maximised JSON comma-array resource consumption, based on the authors' code review. The write-up cites a proof of concept first released August 29, 2026 as "Commas of D00m," plus earlier notes from October 26, 2025 and March 7, 2026 on array and collection denial of service and unconstrained JSON deserializer use. It also references a naïve proof-of-concept script from that earlier work. No CVE identifier or confirmed attacks are named. One excerpt of the thread ends before additional technical findings.

Key facts
  • Daniel Owens posted to Full Disclosure on October 28.
  • Authors say S2-072 and earlier changes do not stop the attack.
  • Proof of concept "Commas of D00m" was released August 29, 2026.
  • The Struts2 claim rests on the authors' plugin code review.
  • No CVE or confirmed attacks are named.
  • October 26, 2025 and March 7, 2026 notes covered related DoS issues.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2025Note on Struts2 array and collection denial of service · Full Disclosure
  2. Mar 7, 2026Overview of unconstrained JSON deserializer resource use · Full Disclosure
  3. Aug 29, 2026"Commas of D00m" proof of concept released · Full Disclosure
  4. Oct 28, 2026Owens posts continuation on Struts2 JSON plugin · Full Disclosure

What each outlet adds

beyond the shared facts
  • Full DisclosureDates the 2025 and March 2026 notes and a naïve script.
  • Full DisclosureNames S2-072, the August 29 PoC, and no CVE or attacks.
Vendors
Apache
Products
Struts2 JSON Plugin

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Full DisclosureFirst report

    Apache Struts2 JSON plugin insecure deserialization report continues

    Daniel Owens cites earlier Struts2 JSON denial-of-service write-ups and a naïve proof-of-concept script; this excerpt ends before new details.

  2. · 1d ago Full Disclosure

    JSON array proof of concept shows parser resource exhaustion

    The authors say Apache Struts2 JSON Plugin changes through S2-072 still do not stop maximised comma-array consumption.