Bug 2516947 (CVE-2026-73635) - CVE-2026-73635 Apache Struts: Apache Struts: Denial of Service via unbounded localized-text caches
Summary: CVE-2026-73635 Apache Struts: Apache Struts: Denial of Service via unbounded ...
Keywords:
Status: NEW
Alias: CVE-2026-73635
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-15 10:51 UTC by OSIDB Bzimport
Modified: 2026-09-04 14:03 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-15 10:51:23 UTC 
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Note You need to log in before you can comment on or make changes to this bug.