CVE-2026-73635

Analyzed Analyzed - Analysis Complete

Allocation of Resources Without Limits in Apache Struts

Publication date: 2026-08-15

Last updated on: 2026-08-18

Assigner: Apache Software Foundation

Description

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-18

Generated

2026-09-05

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-73635

EUVD

EUVD-2026-59604

Affected Vendors & Products

Vendor	Product	Version / Range
apache	struts	From 2.0.0 (inc) to 2.3.37 (inc)
apache	struts	From 2.5.0 (inc) to 2.5.33 (inc)
apache	struts	From 6.0.0 (inc) to 6.11.0 (exc)
apache	struts	From 7.0.0 (inc) to 7.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is an allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request. This allows an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users.

Detection Guidance

Check Apache Struts version to see if it falls within affected ranges (2.0.0-2.3.37, 2.5.0-2.5.33, 6.0.0-6.10.0, 7.0.0-7.2.1). Monitor Java heap usage for unbounded growth in localized-text caches. Look for excessive memory consumption or crashes in Struts applications.

Impact Analysis

The vulnerability can lead to a denial of service where the Java heap is exhausted, causing the application to crash and become unavailable to all users. This impacts availability and can disrupt services relying on Apache Struts.

Compliance Impact

This vulnerability could lead to denial-of-service (DoS) conditions by exhausting system resources, which may disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems, potentially violating Article 32 requirements for security and resilience. For HIPAA, it might affect the availability of systems handling protected health information, risking compliance with the Security Rule's integrity and availability standards.

Mitigation Strategies

Upgrade Apache Struts to version 6.11.0 or 7.3.0. Configure a fixed locale in the application to prevent dynamic cache growth. Restrict network access to Struts applications if possible.

Hi! I’m here to help you understand CVE-2026-73635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70