CVE-2026-73633 in Struts
Summary
by MITRE • 08/14/2026
Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability described represents a critical uncontrolled resource consumption flaw within Apache Struts' JSON plugin, constituting a classic denial-of-service condition that can be exploited to exhaust system resources and disrupt application availability. This weakness specifically manifests when applications are configured to process JSON request bodies through the Struts framework's optional JSON plugin component. The vulnerability stems from the plugin's failure to implement proper bounds checking during the deserialization process of incoming JSON data, allowing malicious actors to craft requests that can consume excessive memory resources without restriction.
The technical implementation of this flaw involves the JSON plugin reading request bodies directly into heap memory without enforcing any configurable limits on the maximum size of data that can be processed. This behavior creates a resource exhaustion scenario where a single malicious request can allocate substantial portions of available heap memory, potentially leading to application crashes or complete system unresponsiveness. The vulnerability is particularly insidious because it operates at the input processing layer, meaning that even applications using the JSON plugin in a limited capacity can become vulnerable if they accept JSON data from untrusted sources. The configuration parameter designed to limit JSON input length proves ineffective as it does not address the core memory consumption issue during the read phase rather than the parsing phase.
From an operational perspective, this vulnerability presents significant risk to organizations relying on Apache Struts frameworks for web application development, particularly those handling user-provided JSON data through action-based request processing. The impact extends beyond simple service disruption to potentially affect business continuity and customer experience, as attackers can exploit this weakness to systematically consume system resources and render applications unavailable to legitimate users. The attack vector requires minimal sophistication and can be executed against any vulnerable application instance, making it particularly dangerous in environments where multiple applications share common infrastructure resources.
Security practitioners should note that this vulnerability aligns with CWE-400, which specifically addresses "Uncontrolled Resource Consumption," and demonstrates characteristics consistent with ATT&CK technique T1499.1, covering "Endpoint Denial of Service". The affected versions span multiple major release lines of Apache Struts, indicating the longevity and widespread nature of this issue within the framework ecosystem. Organizations must prioritize immediate remediation through upgrading to patched versions 6.11.0 or 7.3.0, as these releases contain proper input length validation mechanisms that prevent excessive memory allocation during JSON processing operations. Additionally, defensive measures such as implementing request rate limiting and monitoring for unusual memory consumption patterns can provide additional layers of protection while awaiting full patch deployment across all affected systems.