Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-73635

Apache Struts: Unbounded growth of localized-text caches driven by the request locale

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Struts

Default version status: unaffected

  • 2.0.0 to ≤ 2.3.37affected
  • 2.5.0 to ≤ 2.5.33affected
  • 6.0.0 to ≤ 6.10.0affected
  • 7.0.0 to ≤ 7.2.1affected

References