Do Son 
Apache patched five bugs in Struts 2 this week. Three of them count as Apache Struts DoS flaws that a remote user can trigger. The other two leak data through a shared state bug in the JSON plugin.
Why It Matters
Struts powers many enterprise Java web apps built over the past two decades. So, a wide version range makes these bugs matter for a lot of teams. Three of the five issues need no login at all. An attacker just sends one oversized request and watches memory climb. That kind of denial-of-service risk can take a whole app offline with almost no effort. Meanwhile, the JSON plugin bugs only strike apps that turned on specific, non-default features. Independent researchers, including g0w6y, Michael Mullins, and Kuniyoshi Noguchi, reported all five issues through the normal Apache disclosure process.
How the Flaws Work
JSON Plugin State-Sharing Bugs
First, CVE-2026-73631 and CVE-2026-73632 both stem from shared state inside the JSON plugin. Normally, each request gets its own parsing or serialization data. Here, that data leaks across concurrent requests instead. CVE-2026-73631 can expose one user’s data to another and skip configured input limits, according to the S2-070 advisory. CVE-2026-73632 affects only the SMD and JSON-RPC path inside the JSON interceptor, per the S2-071 bulletin. That path stays off by default. Neither bug touches apps that skip the JSON plugin entirely.
Unbounded Memory Reads Cause Denial of Service
Next, CVE-2026-73633 hits any app that turns on JSON request-body handling. The plugin reads that body into memory with no size cap. So, one big request can exhaust the server’s heap, as the S2-072 advisory explains. Lowering the JSON input limit does not help, since that setting never bounded this specific read. CVE-2026-73634 works the same way but targets a different endpoint. It affects apps that collect Content Security Policy violation reports from browsers. Because browsers submit these reports directly, the endpoint sits open to anyone, per the S2-073 bulletin. Both bugs share one fix: bound how much data the server accepts before parsing it.
Locale Cache Growth Enables Remote DoS
Finally, CVE-2026-73635 stands out because it needs no special feature turned on. Struts picks a locale from each incoming request by default. An attacker can send requests with many different locale values. Each new locale grows an internal cache that never shrinks. Given enough requests, that cache can exhaust the Java heap, the S2-074 advisory confirms. This Apache Struts DoS flaw works against any app that has not set a fixed locale.
Affected Versions
Version exposure varies by bug. The two JSON plugin issues touch only Struts 7.2.1. The three denial-of-service bugs reach back further, into Struts 6.x and even end-of-life 2.x branches. Apache has not published how many live deployments remain on those old versions. No source confirms active exploitation, and no public proof-of-concept exists for any of these five flaws today.
Patch and Mitigation Steps
So, Apache recommends upgrading to Struts 7.3.0 across the board. Teams on the 6.x line can instead move to Struts 6.11.0, which carries the same three DoS fixes. Users who cannot upgrade right away still have options. Turning off SMD support on the JSON interceptor blocks CVE-2026-73632, though that setting is already off by default. Similarly, removing the CSP report-collection endpoint closes off CVE-2026-73634 entirely. Setting a fixed locale through the struts.locale constant stops the cache growth behind CVE-2026-73635. For the unbounded JSON body read, enforce a maximum request size at the reverse proxy. No in-app setting fixes that issue directly. Given how many entry points these bugs touch, patching remains the safest fix for this Apache Struts DoS risk.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
