Skip to content
OpenAdvisories
Medium WID-SEC-2026-2848 5 CVEs

Apache Struts: Mehrere Schwachstellen

Published Aug 13, 2026 · Updated Sep 21, 2026 · Revision 4 · de-DE

Vendor: Apache Vendor: IBM Product: Struts Product: Tivoli Netcool/OMNIbus Product: Tivoli Network Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Struts ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen und zu manipulieren oder um einen Denial of Service zu verursachen.

Product

Struts ist ein Framework für Java-Anwendungen auf dem Webserver Apache.

Vulnerabilities 5

  • High 7.5
    CVE-2026-73633 Public exploit

    Apache Struts: Unbounded read of a JSON request body

    Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single r…

    Apache Software Foundation Apache Struts
  • High 7.5
    CVE-2026-73634

    Apache Struts: Unbounded read of a Content Security Policy violation report

    Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports reads the submitted report into memory without bounding how much it will accept, so a single request…

    Apache Software Foundation Apache Struts
  • High 7.5
    CVE-2026-73635

    Apache Struts: Unbounded growth of localized-text caches driven by the request locale

    Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the fram…

    Apache Software Foundation Apache Struts
  • Medium 4.3
    CVE-2026-73631

    Apache Struts: Shared parsing state in the JSON plugin

    Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsin…

    Apache Software Foundation Apache Struts
  • Medium 4.3
    CVE-2026-73632

    Apache Struts: Shared serialization state in the JSON plugin

    Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. On…

    Apache Software Foundation Apache Struts

Revision history

  1. #4

    Neue Updates von IBM aufgenommen

  2. #3

    Neue Updates von IBM aufgenommen

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-58662, EUVD-2026-59605, EUVD-2026-59604, EUVD-2026-59603, EUVD-2026-59606

  4. #1

    Initiale Fassung

References