Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-104713

Apache Struts: denial of service

Risk score
50/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.7%
Published
5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to …
Affected
Apache Struts before 6.12.0, 7.4.0
Fix
Upgrade Apache Struts to 6.12.0 or 7.4.0 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Apache StrutsTHE FLAWSTHE FIXCVE-2026-104713Denial of serviceCVSS 6.5 · EPSS 1%CVE-2016-3081Apache Struts CommandInjection VulnerabilityCVSS 8.1 · EPSS 96% · exploitedCVE-2026-104711Expression language injectioncan lead to remote codeexecutionCVSS 9.8 · EPSS 1%CVE-2026-104714Race conditionCVSS 8.8 · EPSS 1%Upgrade Apache Struts6.12.0 · 7.4.0or later on your release lineWho is exposed{'products': ['Apache Struts'],'packages': [], 'versions':['2.3.19', '2.3.20.2', '2.3.21','2.3.24.1', '2.3.25', '2.3.28']}RED · ACT TODAYApache StrutsApache Struts 2.3.19 to 2.3.28has a command injectionvulnerability when DynamicMethod Invocation is enabled,allowing remote attackers toexecute arbitrary code.Where it standsExploited in the wildOn CISA's exploited list since 8 OctUS federal deadline 11 OctHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.8 Oct · CISAAdded to the Known Exploited Vulnerabilities list11 Oct · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessDenial of service (CWE-770)202 other warnings in 30 days →Same productEarlier Apache Struts warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Struts: Red, act today. Apache Struts 2.3.19 to 2.3.28 has a command injection vulnerability when Dynamic Method Invocation is enabled, allowing remote attackers to execute arbitrary code.

The flaws

  • CVE-2026-104713: Denial of service (CVSS 6.5 · EPSS 1%)
  • CVE-2016-3081: Apache Struts Command Injection Vulnerability (CVSS 8.1 · EPSS 96% · exploited)
  • CVE-2026-104711: Expression language injection can lead to remote code execution (CVSS 9.8 · EPSS 1%)
  • CVE-2026-104714: Race condition (CVSS 8.8 · EPSS 1%)

The fix

Upgrade Apache Struts: 6.12.0 · 7.4.0 or later on your release line

Who is exposed: {'products': ['Apache Struts'], 'packages': [], 'versions': ['2.3.19', '2.3.20.2', '2.3.21', '2.3.24.1', '2.3.25', '2.3.28']}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 8 Oct
  • US federal deadline 11 Oct

How it unfolded

  1. 8 Oct, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 11 Oct, Deadline (official): US federal agencies must have patched

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Last activity 5 Oct 2026. Patch Forecast updates every hour.