Aller au contenu
en Se connecter
Non notée

CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…

Description

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Struts 7.0 7.0.0 → 7.3.0 Pas de correctif indiqué
Apache Struts 6.0 6.0.0 → 6.11.0 Pas de correctif indiqué
Apache Struts 2.5 2.5.0 → 2.5.33 Pas de correctif indiqué
Apache Struts 2.0 2.0.0 → 2.3.37 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Struts

Les 33 CVE de Apache Struts →
CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin Non notée CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts Non notée CVE-2026-104711 Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')… Non notée CVE-2026-73632 Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts Non notée
Suivre cette CVE