Skip to content
VulniPulse
Sign in
Advisory severityUnratedApache Software Foundation Updated

Advisory [CVE-2026-104712] Asymmetric resource consumption (amplification) vulnerability in Apache Struts

This security Apache Software Foundation advisory covers CVE-2026-104712 affecting Apache Struts.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-104712 Source published Source updated

VulniPulse record published Record updated

CVE-2026-104712
Affected products & platforms
Apache Software FoundationStruts
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.

BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic.

Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.

This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.

Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Affected versions
  • 2.5.14 through 2.5.33
  • 6.0.0 through 6.11.0
  • 7.0.0 through 7.3.0.
  • through 7.3.0

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Fixed versions
  • 6.12.0
  • 7.4.0

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Official advisory · medium-confidence parse· fetched 16 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.