Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN974 _____________________________________________________________________ DATE : 06/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Struts versions prior to 6.12.0, 7.4.0. ==================================================================== https://lists.apache.org/thread.html/8z80cp2b19b25pb93h5w5swcd8bz6fss https://lists.apache.org/thread.html/1nl2500csvmpc20vowf4wgmmwnx8qqjx https://lists.apache.org/thread.html/5z8vq5n12z7yvg23b1mxz74nvsfzgnmf https://lists.apache.org/thread.html/74kczcvmwok2fq3ynhcv7oy61jpmzy9x _____________________________________________________________________ CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin Severity: important Affected versions: - Apache Struts 2.1.8 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0 Description: Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected. This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue. Credit: n0mi1k (finder) References: https://cwiki.apache.org/confluence/display/WW/S2-077 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104713 _____________________________________________________________________ CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests Severity: moderate Affected versions: - Apache Struts 2.0.0 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0 Description: Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue. Credit: n0mi1k (finder) References: https://cwiki.apache.org/confluence/display/WW/S2-078 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104714 _____________________________________________________________________ CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters Severity: moderate Affected versions: - Apache Struts 2.5.14 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0 Description: Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue. Credit: 0xCc.zhang (finder) References: https://cwiki.apache.org/confluence/display/WW/S2-076 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104712 _____________________________________________________________________ CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper Severity: moderate Affected versions: - Apache Struts 2.0.0 through 2.3.37 - Apache Struts 2.5.0 through 2.5.33 - Apache Struts 6.0.0 through 6.11.0 - Apache Struts 7.0.0 through 7.3.0 Description: Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue. Credit: LeaveSong (finder) References: https://cwiki.apache.org/confluence/display/WW/S2-075 https://struts.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-104711 ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================