CVE-2026-104713

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.1.8 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0

Description The REST plugin allows request bodies to be read into memory without limits or throttling. This can lead to the exhaustion of the Java heap if a single request is large enough, resulting in a denial of service for other users. This issue occurs without requiring any additional settings to be enabled, though it only affects applications utilizing the REST plugin.

Recommendations Upgrade versions 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.11.0 to version 6.12.0. Upgrade versions 7.0.0 through 7.3.0 to version 7.4.0.