Skip to content
Heist/ feed
Unrated

Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Type: advisorySource: Official CVE List1 source record

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Announced Source revision 1
Original source ↗

CVE-2026-104712

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-104712

Apache Struts

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Struts",
    "versions": [
      {
        "status": "affected",
        "version": "2.5.14",
        "versionType": "semver",
        "lessThanOrEqual": "2.5.33"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "6.11.0"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "versionType": "semver",
        "lessThanOrEqual": "7.3.0"
      }
    ],
    "packageURL": "pkg:maven/org.apache.struts/struts2-core",
    "packageName": "org.apache.struts:struts2-core",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-104712

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#9307 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement