VulnSocial

CVE-2026-73635Disclosure(apache / struts)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache struts systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1. Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • struts

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 2 mentions (2026-08-14); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
apache
Products
struts

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-08-14: 2Mentions · 2026-08-15: 1Mentions · 2026-08-16: 1Patch / Workaround · 2026-08-15: 1Patch / Workaround · 2026-08-16: 1Technical Details · 2026-08-14: 1Technical Details · 2026-08-15: 1Technical Details · 2026-08-16: 108-1408-1508-16
Signal classification2 categories
Disclosure
250.0%
Patch
250.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-142
Disclosure2
2026-08-151
Patch1
2026-08-161
Patch1
Full discourse4 posts
  • ThreatWire@ThreatWire_
    Patch

    🚨 Apache Struts has patched multiple security issues, including three DoS vulnerabilities tracked as CVE-2026-73633, CVE-2026-73634, and CVE-2026-73635. Two additional flaws affect the JSON plugin, highlighting the risk for applications running affected Struts components. Admins should review the fixes and update to the latest supported release. #ApacheStruts #Apache #CVE #DoS #CyberSecurity #Java #Infosec

    Post summary

    The tweet announces that Apache Struts has patched three DoS CVEs and urges administrators to review and apply updates.

    0201052.0K
    1.6K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Apache Struts DoS flaws span CVE-2026-73633, CVE-2026-73634, and CVE-2026-73635, plus two JSON plugin bugs. Upgrade to 7.3.0. #ApacheStruts #Struts2 #DoS #CVE #JavaWeb #CyberSecurity #InfoSec #Vulnerability https://securityonline.info/apache-struts-dos-flaws-json-plugin/

    Post summary

    The post alerts users to multiple DoS CVEs in Apache Struts and advises upgrading to version 7.3.0 to remediate the issue.

    01050597
    13.0K followersView on X
  • Autumn Good@autumn_good_35
    Disclosure

    Apache Strutsで5件の脆弱性（S2-070～S2-074） CVE-2026-73631 CVE-2026-73632 CVE-2026-73633 CVE-2026-73634 CVE-2026-73635 https://struts.apache.org/announce-2026

    Post summary

    The post announces five new CVEs for Apache Struts, referencing the official Struts announcement page, but provides no technical, exploit, or remediation details.

    02031726
    7.1K followersView on X
  • Kazuki Omo@omokazuki
    Disclosure

    Apache Strutsの脆弱性(Moderate: CVE-2026-73631, CVE-2026-73633, CVE-2026-73634, CVE-2026-73635, Low: CVE-2026-73632) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #apache #struts #dos https://security.sios.jp/vulnerability/struts-security-vulnerability-20260814/

    Post summary

    A tweet announces several newly discovered Apache Struts CVEs, categorizes their severity levels, and links to a detailed vulnerability report.

    00001145
    372 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachestruts---

Explore more

Back to dashboardapache CVEsstruts vulnerabilities