CVE-2026-73633

Overview

Apache Struts is a popular open-source web application framework for developing Java EE web applications. The JSON plugin is an optional component that serializes action results to JSON and, when JSON request-body handling is enabled, populates action properties directly from the body of an incoming request. That request-body path is driven by JSONInterceptor, which hands the servlet request's reader to the plugin's deserialization helper.

A Denial of Service (DoS) vulnerability (CVE-2026-73633) has been identified in the Apache Struts JSON plugin, which allows attackers to exhaust the server's heap memory with a single oversized request body and thereby deny service to other users.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects applications that enable JSON request-body handling through the JSON plugin of Apache Struts. Applications that do not use the JSON plugin are not affected, and neither are applications that use it only to serialize responses, since request-body handling is not enabled by default.

‍

Details

Module Info

• Product: Apache Struts
• Affected packages: org.apache.struts:struts2-json-plugin
• Affected versions: >=2.1.8 <=2.3.37, >=2.5.0 <=2.5.33, >=6.0.0 <=6.10.0, >=7.0.0 <=7.2.1
• GitHub repository: https://github.com/apache/struts
• Published packages: https://central.sonatype.com/artifact/org.apache.struts/struts2-json-plugin
• Package manager: Maven
• Fixed in:
  
  • NES for Apache Struts v2.5.40
  • OSS Apache Struts 6.11.0 and 7.3.0

Vulnerability Info

This High-severity vulnerability is found in the org.apache.struts:struts2-json-plugin package in the request-body deserialization path of Apache Struts.

When an action is configured to be populated from a JSON request body, JSONInterceptor passes the raw servlet reader straight to the plugin's reader-based deserialization helper:

Object obj = JSONUtil.deserialize(request.getReader());

On the Struts 2.5 line that helper accumulates the entire body into a StringBuilder before parsing, and applies no bound of any kind on how much it will accept:

public static Object deserialize(Reader reader) throws JSONException {
    // read content
    BufferedReader bufferReader = new BufferedReader(reader);
    String line;
    StringBuilder buffer = new StringBuilder();

    try {
        while ((line = bufferReader.readLine()) != null) {
            buffer.append(line);
        }
    } catch (IOException e) {
        throw new JSONException(e);
    }

    return deserialize(buffer.toString());
}

The loop reads until end of stream, so the amount of heap allocated is controlled entirely by the attacker: the request body is buffered in full, and a second copy is materialized by buffer.toString() before parsing even begins. An unauthenticated attacker who can reach an action that accepts a JSON body needs only to send an arbitrarily large payload to drive the JVM into heap exhaustion, taking the application down for every other user.

The read is also line-oriented, which defeats length checking even where a limit exists. Because each iteration consumes a whole line, a body that contains no line terminator is accumulated in its entirety during the first iteration, before any per-iteration length comparison could be evaluated. On later Struts lines that added a configurable input-length limit, that limit was therefore checked only after the oversized content had already been buffered, so lowering the configured limit did not reduce exposure.

This vulnerability was introduced in 2009 with Apache Struts 2.1.8.

‍

Mitigation

Struts 2.5 is no longer community-supported. The community support version will not receive any updates to address this issue. Struts 2.5.x was announced End-of-Life on October 30, 2023, effective six months later on April 30, 2024, with 2.5.33 as its final release, per the Apache Struts 2.5.x End-Of-Life (EOL) Announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Apache Struts. The upstream remedy ships in Apache Struts 7.3.0 and, for the 6.x maintenance line, in Apache Struts 6.11.0.
• Where an upgrade is not immediately possible, restrict exposure by disabling JSON request-body handling on actions that do not require it, and by enforcing a maximum request body size at the reverse proxy or servlet container in front of the application.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Michael Mullins (finder)