{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Apache Software Foundation Apache Struts: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/apache-software-foundation--apache-struts/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/apache-software-foundation--apache-struts/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104714/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104714/",
   "title": "CVE-2026-104714 · Apache Software Foundation Apache Struts · disclosed",
   "content_text": "Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.",
   "date_published": "2026-10-05T18:36:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104712/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104712/",
   "title": "CVE-2026-104712 · Apache Software Foundation Apache Struts · disclosed",
   "content_text": "Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\n\nThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.",
   "date_published": "2026-10-05T18:35:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104711/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104711/",
   "title": "CVE-2026-104711 · Apache Software Foundation Apache Struts · disclosed",
   "content_text": "Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.",
   "date_published": "2026-10-05T18:35:10Z"
  }
 ]
}