High · published August 15, 2026
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
| Product | Versions | Fixed in |
|---|---|---|
| apache/struts | ≥ 2.0.0, ≤ 2.3.37 | — |
| apache/struts | ≥ 2.5.0, ≤ 2.5.33 | — |
| apache/struts | ≥ 6.0.0, < 6.11.0 | 6.11.0 |
| apache/struts | ≥ 7.0.0, < 7.3.0 | 7.3.0 |