CVE-2026-73633
Received Received - Intake

Uncontrolled Resource Consumption in Apache Struts JSON Plugin

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Apache Software Foundation

Description
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73633
EUVD
EUVD-2026-58662

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
apache struts From 2.1.8 (inc) to 2.3.37 (inc)
apache struts From 2.5.0 (inc) to 2.5.33 (inc)
apache struts From 6.0.0 (inc) to 6.10.0 (inc)
apache struts From 7.0.0 (inc) to 7.2.1 (inc)
apache struts 6.11.0
apache struts 7.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an uncontrolled resource consumption vulnerability in Apache Struts' JSON plugin. When enabled, the plugin reads JSON request bodies into memory without limits, allowing a single request to exhaust server heap memory and cause a denial of service for other users. The issue occurs because the plugin's JSON input length limit does not restrict this read.

Detection Guidance

Check if your Apache Struts application uses the JSON plugin by inspecting configuration files for JSON request-body handling settings. Monitor server logs for unusually large JSON payloads or memory exhaustion errors during request processing.

Impact Analysis

An attacker could send a specially crafted JSON request that consumes all available server memory, crashing the application or making it unresponsive for legitimate users. This leads to service disruption and potential downtime. Only applications using the JSON plugin with JSON request-body handling are affected.

Mitigation Strategies

Upgrade Apache Struts to version 6.11.0 or 7.3.0. If immediate upgrade is not possible, enforce a maximum request body size at the reverse proxy or servlet container level to limit JSON payload sizes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart