CVE-2026-104712: apache software foundation apache struts

Vulnerability summary

CVE-2026-104712 is a high (CVSS 7.5) vulnerability in apache software foundation apache struts. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.4% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

• CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."