CVE-2026-73631

Name of the Vulnerable Software and Affected Versions Apache Struts version 7.2.1

Description A data exposure issue exists in the JSON plugin of Apache Struts where per-request parsing state may be shared across concurrent requests. This allows data from one request to be observable in another and prevents configured parsing limits from being enforced correctly. This issue only affects applications that have enabled the population of actions from a JSON request body, as this feature is disabled by default.

Recommendations Upgrade to version 7.3.0.