CVE-2026-104714

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0

Description A race condition occurs when a localized message formats a date or time argument. The application-wide text provider retains a formatter that is shared across concurrent requests without proper isolation. This can lead to a scenario where data belonging to one user is displayed in another user's response or causes a server error during rendering. Applications that do not use date or time arguments in localized messages are not affected.

Recommendations Upgrade versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.11.0 to version 6.12.0. Upgrade versions 7.0.0 through 7.3.0 to version 7.4.0.