Threats Tagged 'cve-2026-73634'

Apache Struts contains an uncontrolled resource consumption vulnerability affecting versions 6.0.0 through 6.10.0 and 7.0.0 through 7.2.1. The vulnerability arises in applications exposing an endpoint that collects Content Security Policy violation reports, where the submitted report is read into memory without limits, allowing a single request to exhaust heap memory and cause denial of service. This endpoint is typically unauthenticated. The core Apache Struts distribution does not map such an endpoint by default, so only applications that implement this feature are affected. Upgrading to versions 6.11.0 or 7.3.0 resolves the issue.

Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. Such endpoints are ordinarily reachable without authentication. The core distribution maps no such endpoint by default; applications that do not collect violation reports are not affected. This issue affects Apache Struts: from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.