CVE-2026-73635

published 2026-08-15

CVE-2026-73635: Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text…

Priority P3 47 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
apache	struts	2.0.0 – 2.3.37	—
apache	struts	2.5.0 – 2.5.33	—
apache	struts	>= 6.0.0 < 6.11.0	6.11.0
apache	struts	>= 7.0.0 < 7.3.0	7.3.0
apache_software_foundation	apache_struts	2.0.0 – 2.3.37	—
apache_software_foundation	apache_struts	2.5.0 – 2.5.33	—
apache_software_foundation	apache_struts	6.0.0 – 6.10.0	—
apache_software_foundation	apache_struts	7.0.0 – 7.2.1	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vendor_redhat 7.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-770