High [CVE-2026-73635] Denial of Service via unbounded localized-text caches
This high-severity Red Hat Linux advisory covers CVE-2026-73635.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Allocation of resources without limits or throttling vulnerability in Apache Struts.
When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue. This can lead to the exhaustion of Java heap memory, resulting in a Denial of Service (DoS) for other users.
An uncontrolled resource consumption flaw exists in the Apache Struts localized-text lookup caching mechanism. An unauthenticated remote attacker can exploit this by streaming requests with arbitrary, unique locale parameters, exhausting JVM heap space and causing a denial of service.
The impact is limited to process availability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-770. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Fuse 7 as not affected.
- 2.0.0
- 2.3.37
- 2.5.0
- 2.5.33
- 6.0.0
- 6.10.0
- 7.0.0
- 7.2.1
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
- 6.11.0
- 7.3.0
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Configure a fixed default locale in `struts.xml` by setting the `struts.locale` property (e.g., `<constant name="struts.locale" value="en_US" />`). Alternatively, configure an API gateway or web application firewall (WAF) to sanitize or strip non-standard `Accept-Language` headers before forwarding traffic to the application.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.