Medium · 4.3 CVE-2026-73632 EUVD-2026-59606GHSA-87hf-473v-8h9c

Apache Struts: Shared serialization state in the JSON plugin

Published Aug 15, 2026 · Updated Aug 17, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Struts

Description

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.

This issue affects Apache Struts: 7.2.1.

Users are recommended to upgrade to version 7.3.0, which fixes the issue.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Struts	7.2.1	—

Advisories 1

WID-SEC-2026-2848 Apache Struts: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 21, 2026

References

https://cwiki.apache.org/confluence/display/WW/S2-071 vendor-advisory