Skip to content
OpenAdvisories
High WID-SEC-2026-3723 4 CVEs

Apache Struts: Mehrere Schwachstellen

Published Oct 4, 2026 · Updated Oct 15, 2026 · Revision 3 · de-DE

Vendor: Apache Vendor: IBM Product: Struts Product: Tivoli Netcool/OMNIbus Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Struts ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Struts ist ein Framework für Java-Anwendungen auf dem Webserver Apache.

Vulnerabilities 4

  • Critical 9.8
    CVE-2026-104711 Public exploit

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OG…

    Apache Software Foundation Apache Struts
  • High 8.8
    CVE-2026-104714

    Apache Struts: Shared message formatter exposes date and time values across concurrent requests

    Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provide…

    Apache Software Foundation Apache Struts
  • High 7.5
    CVE-2026-104712

    Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

    Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce…

    Apache Software Foundation Apache Struts
  • Medium 6.5
    CVE-2026-104713

    Apache Struts: Unbounded request body read in the REST plugin

    Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion t…

    Apache Software Foundation Apache Struts

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-92625, EUVD-2026-92624, EUVD-2026-92622, EUVD-2026-92623

  3. #1

    Initiale Fassung

References