CVE-2026-73635

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.10.0 Apache Struts versions 7.0.0 through 7.2.1

Description An unauthenticated remote client can cause the internal localized-text caches to grow without bound and exhaust the Java heap, leading to a denial of service. This occurs when no fixed locale is configured, as the framework takes the locale used for localized-text lookups directly from the incoming request.

Recommendations Upgrade versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.10.0 to version 6.11.0. Upgrade versions 7.0.0 through 7.2.1 to version 7.3.0. Configure a fixed locale to prevent the framework from using the locale provided in the incoming request.