G0W6Y

**Name of the Vulnerable Software and Affected Versions** swift-nio versions prior to 2.101.0 **Description** An unauthenticated remote peer can cause a crash in any NIOWebSocket-based server, such as Vapor and Hummingbird. This occurs when a single 11-byte frame is sent following a completed WebSocket handshake, resulting in the termination of all active connections until the process is restarted. **Recommendations** Update swift-nio to version 2.101.0.

**Name of the Vulnerable Software and Affected Versions** Apache Struts version 7.2.1 **Description** A data exposure issue exists in the JSON plugin of Apache Struts where per-request parsing state may be shared across concurrent requests. This allows data from one request to be observable in another and prevents configured parsing limits from being enforced correctly. This issue only affects applications that have enabled the population of actions from a JSON request body, as this feature is disabled by default. **Recommendations** Upgrade to version 7.3.0.

**Name of the Vulnerable Software and Affected Versions** Apache Struts version 7.2.1 **Description** A data exposure issue exists in the JSON plugin where per-response serialization state may be shared across concurrent requests. This allows response content from one request to be observed by another. The issue specifically affects the SMD / JSON-RPC handling of the JSON interceptor, which is disabled by default. Applications utilizing the json result type are not impacted. **Recommendations** Upgrade to version 7.3.0.