High · published October 5, 2026
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
| Product | Versions | Fixed in |
|---|---|---|
| apache/struts | ≥ 2.0.0, ≤ 2.3.37 | — |
| apache/struts | ≥ 2.5.0, ≤ 2.5.33 | — |
| apache/struts | ≥ 6.0.0, < 6.12.0 | 6.12.0 |
| apache/struts | ≥ 7.0.0, < 7.4.0 | 7.4.0 |