Aller au contenu
en Se connecter
Non notée

CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts

Description

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Struts 7.0 7.0.0 → 7.3.0 Pas de correctif indiqué
Apache Struts 6.0 6.0.0 → 6.11.0 Pas de correctif indiqué
Apache Struts 2.5 2.5.14 → 2.5.33 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Struts

Les 33 CVE de Apache Struts →
CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache… Non notée CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin Non notée CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… Non notée CVE-2026-73632 Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts Non notée
Suivre cette CVE