Login Request a demo
Medium severity · published Oct 5, 2026
CVE-2026-104713
Apache Struts: Unbounded request body read in the REST plugin
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Struts · Apache
2.1.8 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 · source: vendor, NVD
Affected product
ST
Struts
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104713
vendor-advisory
https://cwiki.apache.org/confluence/display/WW/S2-077
More from Struts
9.8
CVE-2020-17530
Apache Struts Remote Code Execution Vulnerability
9.8
CVE-2017-9791
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage
9.8
CVE-2017-5638
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload…
9.8
CVE-2013-2251
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:…
9.8
CVE-2012-0391
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of…