CVE-2026-73635 in Struts
Summary
by MITRE • 08/15/2026
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in Apache Struts represents a critical resource exhaustion flaw that enables denial of service attacks through uncontrolled memory allocation. This issue stems from the framework's handling of localized text lookups when no fixed locale is configured, creating an attack surface where remote unauthenticated clients can manipulate internal cache structures to consume excessive heap memory.
The technical implementation flaw occurs within the framework's internationalization subsystem where locale information is dynamically extracted from incoming HTTP requests rather than being constrained by predefined application settings. This design decision allows attackers to submit malformed or excessively varied locale parameters that result in unlimited growth of internal localized-text caches. The absence of rate limiting or resource constraints on cache expansion means that each unique locale parameter triggers the creation of new cache entries, leading to unbounded memory consumption over time.
From a security perspective, this vulnerability aligns with CWE-400, which categorizes unchecked resource allocation as a fundamental weakness in software design. The attack pattern follows established methods described in MITRE ATT&CK technique T1499.004, specifically targeting availability through resource exhaustion. The impact extends beyond simple service disruption to potentially compromising the entire application runtime environment through heap exhaustion that can cause JVM crashes or severe performance degradation affecting legitimate users.
The affected versions span multiple major release lines of Apache Struts, indicating a persistent architectural issue that was not adequately addressed across different framework iterations. This widespread impact affects installations from version 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.10.0, representing a substantial portion of deployments that relied on the framework's default configuration behavior.
Organizations can mitigate this vulnerability by implementing the recommended upgrades to version 6.11.0 or 7.3.0, which include proper resource limiting mechanisms for cache expansion. Additionally, administrators should consider implementing request rate limiting at network boundaries and monitoring heap usage patterns to detect potential exploitation attempts. Applications that have explicitly configured fixed locales are unaffected, making this a configuration-dependent vulnerability that highlights the importance of proper security hardening practices in web application frameworks.
The fix implemented in newer versions addresses the root cause by introducing proper bounds checking and cache management policies that prevent unlimited growth of internal data structures while maintaining backward compatibility for legitimate use cases. This remediation approach follows security best practices established in industry standards for preventing resource exhaustion attacks through proper input validation and resource management controls.