VulnSocial

CVE-2026-73633Patch(apache / struts)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache struts systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • struts

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 3d ago at 2 mentions (2026-08-14); latest day: 1
  • 5 total mentions across 4 days

Affected systems

Vendors
apache
Products
struts

Deep dive

Activity timeline5 mentions / 4d
01122Mentions · 2026-08-14: 2Mentions · 2026-08-15: 1Mentions · 2026-08-16: 1Mentions · 2026-08-21: 1Patch / Workaround · 2026-08-15: 1Patch / Workaround · 2026-08-16: 1Patch / Workaround · 2026-08-21: 1Technical Details · 2026-08-15: 1Technical Details · 2026-08-16: 1Technical Details · 2026-08-21: 108-1408-1508-1608-21
Signal classification3 categories
Patch
360.0%
Disclosure
120.0%
General
120.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-142
Disclosure1General1
2026-08-151
Patch1
2026-08-161
Patch1
2026-08-211
Patch1
Full discourse5 posts
  • ThreatWire@ThreatWire_
    Patch

    🚨 Apache Struts has patched multiple security issues, including three DoS vulnerabilities tracked as CVE-2026-73633, CVE-2026-73634, and CVE-2026-73635. Two additional flaws affect the JSON plugin, highlighting the risk for applications running affected Struts components. Admins should review the fixes and update to the latest supported release. #ApacheStruts #Apache #CVE #DoS #CyberSecurity #Java #Infosec

    Post summary

    Apache Struts has released patches for three DoS vulnerabilities (CVE-2026-73633/34/35) and two JSON plugin flaws, urging administrators to update to the latest supported release.

    0201052.0K
    1.6K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Apache Struts DoS flaws span CVE-2026-73633, CVE-2026-73634, and CVE-2026-73635, plus two JSON plugin bugs. Upgrade to 7.3.0. #ApacheStruts #Struts2 #DoS #CVE #JavaWeb #CyberSecurity #InfoSec #Vulnerability https://securityonline.info/apache-struts-dos-flaws-json-plugin/

    Post summary

    The post highlights Apache Struts DoS vulnerabilities (CVE-2026-73633, 73634, 73635) and two JSON plugin bugs, recommending users upgrade to version 7.3.0 to mitigate the issue.

    01050597
    13.0K followersView on X
  • Autumn Good@autumn_good_35
    General

    Apache Strutsで5件の脆弱性（S2-070～S2-074） CVE-2026-73631 CVE-2026-73632 CVE-2026-73633 CVE-2026-73634 CVE-2026-73635 https://struts.apache.org/announce-2026

    Post summary

    The post announces five new Apache Struts vulnerabilities (CVE‑2026‑73631 to CVE‑2026‑73635) and directs readers to an Apache announcement page.

    02031726
    7.1K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: Uncontrolled Resource Consumption in #ApacheStruts. #CVE-2026-73633 CVSS: 7.5. This #vulnerability can lead to denial of service #DoS. Time to #Patch #Patch #Patch

    Post summary

    The post warns about CVE-2026-73633, an uncontrolled resource consumption flaw in Apache Struts that can cause DoS, and urges users to apply the available patch.

    01011336
    7.2K followersView on X
  • Kazuki Omo@omokazuki
    Disclosure

    Apache Strutsの脆弱性(Moderate: CVE-2026-73631, CVE-2026-73633, CVE-2026-73634, CVE-2026-73635, Low: CVE-2026-73632) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #apache #struts #dos https://security.sios.jp/vulnerability/struts-security-vulnerability-20260814/

    Post summary

    The post discloses five new Apache Struts CVEs with associated severity ratings and links to a detailed vendor page.

    00001145
    372 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachestruts---

Explore more

Back to dashboardapache CVEsstruts vulnerabilities