Description

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-14T14:16:51.997Z",
  "pubdate": "2026-08-14T14:16:51.997Z",
  "executiveSummary": "An uncontrolled resource consumption vulnerability exists in the optional JSON plugin of Apache Struts, specifically related to the handling of JSON request bodies when configured to populate actions. The root cause stems from the application reading incoming request payloads into memory without enforcing proper size boundaries, effectively bypassing the plugin's configurable JSON input length limit. An unauthenticated remote attacker can exploit this flaw by submitting a maliciously crafted, oversized HTTP request containing a massive JSON payload. The immediate consequence of successful exploitation is memory exhaustion leading to an OutOfMemoryError, which crashes the Java Virtual Machine heap and induces a complete Denial of Service (DoS) for legitimate users. Affected systems include Apache Struts versions 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.10.0, and 7.0.0 through 7.2.1, provided the vulnerable JSON plugin component is deployed and configured to ingest JSON request bodies. The risk implication is high availability degradation, requiring minimal attacker capabilities beyond network connectivity to the target application endpoint. Remediation necessitates upgrading to patched software versions or disabling the vulnerable component if JSON request-body handling is not strictly required by business logic.",
  "technicalDetails": "The vulnerability resides within the JSON plugin component of Apache Struts, which is an optional module utilized for serializing and deserializing JSON data. Specifically, the flaw is triggered when an application leverages the plugin capability to automatically populate action properties directly from an incoming HTTP JSON request body. The root cause of the vulnerability is an unbounded memory allocation routine during the deserialization and reading phase of the request stream. When the plugin processes a request, it reads the entire payload into memory to parse the structured data. Unlike intended operational limits, the plugin's configurable JSON input length restriction fails to constrain this initial read operation properly. Consequently, an attacker can transmit an arbitrarily large HTTP request payload, forcing the underlying Java servlet container and Apache Struts framework to allocate excessive contiguous memory on the heap to buffer the input stream. Step-by-step, the attack flow begins with the attacker identifying an Apache Struts application endpoint that utilizes the JSON plugin with request-body population enabled. The attacker crafts a Hypertext Transfer Protocol (HTTP) POST or PUT request containing a massively oversized JSON payload designed to consume all available heap memory. Upon transmission, the vulnerable Apache Struts server receives the request and initiates the parsing routine via the JSON plugin. Because input boundary enforcement is absent or circumvented during the read operation, the application continuously consumes memory until the JVM heap is completely exhausted. This results in an immediate OutOfMemoryError exception, causing the application thread pool to hang or the entire Java Virtual Machine process to crash, resulting in a permanent Denial of Service (DoS) condition affecting all users. The vulnerability affects Apache Struts versions from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, and from 7.0.0 through 7.2.1. Exploitation requires network exposure to the vulnerable endpoint but does not require prior authentication or elevated privileges, lowering the barrier to entry for potential threat actors."
}