CVE-2026-104713Medium· 6.5▾ SunlitAllocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 6.5
none → medium
0.2%
Last analysed / modified upstream
0.2% → 0.7%
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
struts >= 2.1.8, <= 2.3.37struts >= 2.5.0, <= 2.5.33struts >= 6.0.0, < 6.12.0struts >= 7.0.0, < 7.4.0Upgrade past the affected range:
struts 7.4.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104712High· 7.5Asymmetric resource consumption (amplification) vulnerability in Apache Struts
CVE-2022-36124High· 7.5It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system
CVE-2016-1182High· 8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, …
CVE-2021-35517High· 7.5When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs
CVE-2020-26258Medium· 6.3XStream is a Java library to serialize objects to XML and back again
CVE-2020-26259Medium· 6.8XStream is a Java library to serialize objects to XML and back again