CVE-2026-73632

Analyzed Analyzed - Analysis Complete

Session Data Exposure in Apache Struts JSON Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-18

Assigner: Apache Software Foundation

Description

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected. This issue affects Apache Struts: 7.2.1. Users are recommended to upgrade to version 7.3.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-18

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-73632

EUVD

EUVD-2026-59606

Affected Vendors & Products

Vendor	Product	Version / Range
apache	struts	7.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-567	The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

Attack-Flow Graph

Executive Summary

This vulnerability involves a flaw in Apache Struts' JSON plugin where response data from one user's request could be exposed to another user's session. This happens because the serialization state is shared across concurrent requests, allowing sensitive information to leak between different users.

Detection Guidance

This vulnerability affects Apache Struts 7.2.1 and is related to the JSON plugin's response serialization state being shared across concurrent requests. Detection involves checking for unusual response content mixing between different user sessions or requests. No specific commands are provided in the context, but monitoring for inconsistent JSON responses or session data leakage may indicate exploitation.

Impact Analysis

If you use Apache Struts 7.2.1 with the SMD or JSON-RPC handling enabled, an attacker could potentially access data from other users' requests. This could lead to unauthorized access to sensitive information such as session tokens, personal data, or other confidential details.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Upgrade Apache Struts to version 7.3.0 or later to fix the vulnerability. Since the JSON plugin's SMD/JSON-RPC handling is affected and not enabled by default, verify if your application uses the json result type or the vulnerable plugin components.

Hi! I’m here to help you understand CVE-2026-73632. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70