Listen to this Post
CVE-2026-73633, also tracked as Apache Struts S2-072, is an uncontrolled resource consumption vulnerability (CWE-400) affecting the JSON plugin of Apache Struts. The flaw resides in how the plugin handles JSON request bodies when an application is configured to populate action objects from incoming JSON data.
When a request containing a JSON payload is received, the plugin’s parser reads the entire request body into memory without imposing any upper bound on the size it will accept. Although the plugin offers a configurable JSON input length limit, this setting does not constrain the initial read operation. Consequently, a single attacker-controlled request with an oversized JSON payload can force the server to allocate a massive amount of heap memory. This can exhaust the available heap, leading to a denial of service (DoS) condition where the application becomes unresponsive to legitimate users.
The JSON plugin is an optional component, and applications that do not use it or have not enabled JSON request-body handling are not affected. However, for those that do, the impact is significant. The vulnerability affects a wide range of Apache Struts versions, including the end-of-life 2.3.x and 2.5.x lines, as well as the 6.0.0 through 6.10.0 and 7.0.0 through 7.2.1 releases. The issue is resolved in Struts versions 6.11.0 and 7.3.0. The CVSS 3.1 score for this vulnerability is 7.5, indicating a High severity.
DailyCVE Form:
Platform: Apache Struts
Version: 2.1.8-2.3.37, 2.5.0-2.5.33, 6.0.0-6.10.0, 7.0.0-7.2.1
Vulnerability: Unbounded JSON read
Severity: High (CVSS 7.5)
date: 2026-08-14
Prediction: Patch already available (6.11.0/7.3.0)
What Undercode Say:
Analytics & Detection
To identify if your application is using the vulnerable JSON plugin, check your project dependencies. On a Linux-based system, you can use the following command to search for the `struts2-json-plugin` JAR file:
find /path/to/your/app -name "struts2-json-plugin-.jar"
To check the version of Struts in use, look for the `struts2-core` JAR:
find /path/to/your/app -name "struts2-core-.jar"
The presence of the plugin with a version in the affected range indicates vulnerability. You can also monitor server logs for signs of memory exhaustion, which may manifest as `java.lang.OutOfMemoryError: Java heap space` errors.
Exploit: (Educational Purposes!)
A proof-of-concept (PoC) for this vulnerability is publicly available. The attack works by sending a single HTTP POST request with a very large JSON body to a vulnerable endpoint.
An example of a malicious request might look like this:
POST /login.action HTTP/1.1
Host: target.com
Content-Type: application/json
Content-Length: 50000000
{"data": "[PAYLOAD OF 50MB or MORE]"}
The PoC tool from the `CuteeCat/CVE-2026-73633` repository can be used to test a target. After setting up the environment, the exploit is executed with:
python poc.py --url http://127.0.0.1:8080/login.action --size 100
The `–size` parameter controls the size of the payload, with larger values causing greater memory and CPU consumption.
Protection:
The primary and recommended protection is to upgrade to a patched version of Apache Struts:
– For users on the 6.x line, upgrade to version 6.11.0 or later.
– For users on the 7.x line, upgrade to version 7.3.0 or later.
If an immediate upgrade is not feasible, consider these interim mitigations:
1. Disable JSON request-body handling in the application’s Struts configuration.
2. Remove the `struts2-json-plugin` from the application’s classpath if it is not required.
3. Restrict the maximum allowed size of incoming requests at the web server or reverse-proxy level (e.g., using `client_max_body_size` in Nginx or `LimitRequestBody` in Apache) to limit the impact of a large payload.
Impact:
Successful exploitation of CVE-2026-73633 leads to a Denial of Service (DoS) . An unauthenticated attacker can send a single, large HTTP request, causing the server to allocate excessive memory. This can quickly exhaust the Java heap, making the application unresponsive to all other users. The attack can cause significant CPU spikes as well, as the server struggles to process the oversized payload. The vulnerability poses a high risk to the availability of web applications, especially those that are publicly accessible and handle JSON requests.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
