CVE-2026-73633
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-400
Consumo de recursos no controlado (Agotamiento de recursos)
Fecha de publicación:
14/08/2026
Última modificación:
14/08/2026
Descripción
*** Pendiente de traducción *** Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin&#39;s configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected.<br />
<br />
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.<br />
<br />
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA