CVE-2026-73633: CWE-400 Uncontrolled Resource Consumption in Apache Software Foundation Apache Struts
An uncontrolled resource consumption vulnerability exists in the JSON plugin of Apache Struts. When configured to populate actions from a JSON request body, the plugin reads the entire body into memory without properly limiting the size, potentially exhausting heap memory and causing denial of service. The plugin's configurable JSON input length limit does not effectively bound this behavior. This vulnerability affects specific versions of Apache Struts and is fixed in versions 6.11.0 and 7.3.0.
AI Analysis
Technical Summary
CVE-2026-73633 is a high-severity vulnerability in the JSON plugin of Apache Struts. The flaw arises when the plugin is configured to populate actions from a JSON request body, as it reads the request body into memory without bounding the amount of data accepted. This can lead to uncontrolled resource consumption, exhausting heap memory and resulting in denial of service to other users. The plugin's configurable JSON input length limit does not prevent this unbounded read. The vulnerability affects Apache Struts versions from 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.10.0, and 7.0.0 through 7.2.1. Upgrading to versions 6.11.0 or 7.3.0 resolves the issue.
Potential Impact
Successful exploitation can cause denial of service by exhausting heap memory on the affected system, impacting availability. There is no impact on confidentiality or integrity. The vulnerability requires no privileges or user interaction and can be exploited remotely over the network.
Mitigation Recommendations
Users should upgrade affected Apache Struts installations to version 6.11.0 or 7.3.0, where this vulnerability is fixed. Applications not using the JSON plugin or not enabling JSON request-body handling are not affected. No other mitigations are specified.
CVE-2026-73633: CWE-400 Uncontrolled Resource Consumption in Apache Software Foundation Apache Struts
Description
An uncontrolled resource consumption vulnerability exists in the JSON plugin of Apache Struts. When configured to populate actions from a JSON request body, the plugin reads the entire body into memory without properly limiting the size, potentially exhausting heap memory and causing denial of service. The plugin's configurable JSON input length limit does not effectively bound this behavior. This vulnerability affects specific versions of Apache Struts and is fixed in versions 6.11.0 and 7.3.0.
CVSS v3.1
Score 7.5high
Affected software
pkg:maven/org.apache.struts/struts2-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73633 is a high-severity vulnerability in the JSON plugin of Apache Struts. The flaw arises when the plugin is configured to populate actions from a JSON request body, as it reads the request body into memory without bounding the amount of data accepted. This can lead to uncontrolled resource consumption, exhausting heap memory and resulting in denial of service to other users. The plugin's configurable JSON input length limit does not prevent this unbounded read. The vulnerability affects Apache Struts versions from 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.10.0, and 7.0.0 through 7.2.1. Upgrading to versions 6.11.0 or 7.3.0 resolves the issue.
Potential Impact
Successful exploitation can cause denial of service by exhausting heap memory on the affected system, impacting availability. There is no impact on confidentiality or integrity. The vulnerability requires no privileges or user interaction and can be exploited remotely over the network.
Mitigation Recommendations
Users should upgrade affected Apache Struts installations to version 6.11.0 or 7.3.0, where this vulnerability is fixed. Applications not using the JSON plugin or not enabling JSON request-body handling are not affected. No other mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-335q-cpqh-m68h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73633"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7f43e8bf8831d5395d5f54
Added to database: 08/14/2026, 16:35:52 UTC
Last enriched: 08/14/2026, 16:39:38 UTC
Last updated: 09/28/2026, 17:18:50 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.