Patch Forecast
Amber warning
Patch this week.

CVE-2026-104712

Asymmetric resource consumption (amplification) vulnerability in Apache Struts

Risk score
62/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.9%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request…
Affected
Apache Struts before 6.12.0, 7.4.0
Fix
Upgrade Apache Struts to 6.12.0 or 7.4.0 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache StrutsTHE FLAWSTHE FIXCVE-2026-104712Asymmetric resourceconsumption (amplification)vulnerability in Apache StrutsCVSS 7.5 · EPSS 1%CVE-2016-3081Apache Struts CommandInjection VulnerabilityCVSS 8.1 · EPSS 96% · exploitedCVE-2026-104711Expression language injectioncan lead to remote codeexecutionCVSS 9.8 · EPSS 1%CVE-2026-104714Race conditionCVSS 8.8 · EPSS 1%Upgrade Apache Struts6.12.0 · 7.4.0or later on your release lineWho is exposed{'products': ['Apache Struts'],'packages': [], 'versions':['2.3.19', '2.3.20.2', '2.3.21','2.3.24.1', '2.3.25', '2.3.28']}RED · ACT TODAYApache StrutsApache Struts 2.3.19 to 2.3.28has a command injectionvulnerability when DynamicMethod Invocation is enabled,allowing remote attackers toexecute arbitrary code.Where it standsExploited in the wildOn CISA's exploited list since 8 OctUS federal deadline 11 OctHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.8 Oct · CISAAdded to the Known Exploited Vulnerabilities list11 Oct · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessCWE-405 (CWE-405)12 other warnings in 30 days →Same productEarlier Apache Struts warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Struts: Red, act today. Apache Struts 2.3.19 to 2.3.28 has a command injection vulnerability when Dynamic Method Invocation is enabled, allowing remote attackers to execute arbitrary code.

The flaws

  • CVE-2026-104712: Asymmetric resource consumption (amplification) vulnerability in Apache Struts (CVSS 7.5 · EPSS 1%)
  • CVE-2016-3081: Apache Struts Command Injection Vulnerability (CVSS 8.1 · EPSS 96% · exploited)
  • CVE-2026-104711: Expression language injection can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-104714: Race condition (CVSS 8.8 · EPSS 1%)

The fix

Upgrade Apache Struts: 6.12.0 · 7.4.0 or later on your release line

Who is exposed: {'products': ['Apache Struts'], 'packages': [], 'versions': ['2.3.19', '2.3.20.2', '2.3.21', '2.3.24.1', '2.3.25', '2.3.28']}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 8 Oct
  • US federal deadline 11 Oct

How it unfolded

  1. 8 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 11 Oct, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Last activity 5 Oct 2026. Patch Forecast updates every hour.