CVE-2026-104712

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.5.14 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0

Description An asymmetric resource consumption (amplification) issue exists when a request parameter is bound to a java.math.BigDecimal property and subsequently rendered via the Struts tag library. This allows an unauthenticated remote attacker to trigger responses significantly larger than the initial request, potentially exhausting server CPU and outbound network capacity through sustained low-volume traffic.

Recommendations Upgrade versions 2.5.14 through 2.5.33 to version 6.12.0 or 7.4.0. Upgrade versions 6.0.0 through 6.11.0 to version 6.12.0 or 7.4.0. Upgrade versions 7.0.0 through 7.3.0 to version 7.4.0.