CVE-2026-73635 Apache Software Foundation CVE debrief

Who should care

Apache Struts users, administrators, and security teams should be aware of this vulnerability and take necessary actions to upgrade or mitigate the risk. Those who use Apache Struts in their applications, especially in production environments, should prioritize addressing this vulnerability. Security teams should review and adjust configurations to ensure a fixed locale is set and monitor for unusual activity and heap usage. Additionally, operators and platform administrators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Asset inventory management should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Change management processes should consider rollback/change windows for remediation efforts. Source tracking should be implemented to monitor for updates from the vendor and other sources related to this vulnerability. Security teams should also consider the operational impact of this vulnerability and the source-confidence limits of the information provided. Review context and adjust configurations accordingly to prevent exploitation. This should be done in the context of existing security practices and in coordination with relevant stakeholders. The goal is to minimize potential impact and ensure the security of affected systems. This overview aims to provide a comprehensive understanding of the vulnerability and its implications for affected users and operators. It is crucial for all stakeholders to take proactive measures to address this vulnerability and prevent potential attacks. By doing so, they can help protect their systems and data from potential exploitation. The information provided,

Technical summary

An allocation of resources without limits or throttling vulnerability in Apache Struts can cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. This issue affects Apache Struts versions from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, and from 7.0.0 through 7.2.1. Applications that configure a fixed locale are not affected.

Defensive priority

Apache Struts users should prioritize upgrading to version 6.11.0 or 7.3.0 to address the vulnerability.

Recommended defensive actions

• Upgrade to Apache Struts version 6.11.0 or 7.3.0
• Review and adjust configurations to ensure a fixed locale is set
• Monitor for unusual activity and heap usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record indicates an allocation of resources without limits or throttling vulnerability in Apache Struts, which can cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. This issue affects Apache Struts versions from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, and from 7.0.0 through 7.2.1.

Official resources