Apache Struts CVE-2026-104712

Exploitation requires the target application to BOTH (1) bind an incoming request parameter to a java.math.BigDecimal property and (2) render that property through the Struts tag library; applications missing either behavior are not affected per the advisory. No authentication or user interaction is needed (PR:N/UI:N) and the attack is network-remote with low volume. Limiting factors: the BigDecimal-bound, tag-rendered code path is an application-design prerequisite (not present in all Struts apps), the affected version must be in range (2.5.14-2.5.33, 6.0.0-6.11.0, 7.0.0-7.3.0), and impact is confined to availability (no data exposure or code execution).

Signals point to a genuine but conditional availability risk rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects an unauthenticated, network-reachable denial-of-service with no confidentiality or integrity impact - consistent with the CWE-405 (asymmetric resource consumption) classification. EPSS is low at 0.28% (19th percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced in the input, so there is no evidence of active or imminent mass exploitation. The most important moderating factor is that the vulnerability only manifests when an application binds a request parameter to a java.math.BigDecimal property AND renders it through the Struts tag library; applications not doing both are explicitly unaffected. This means the effective attack surface is a subset of Struts deployments, not all of them - the raw 7.5 overstates universal risk. The 'Information Disclosure' tag in the input is inconsistent with the CVSS vector (C:N) and the amplification/DoS nature of the flaw and should be disregarded. Net: prioritize for patching on internet-facing Struts apps that use BigDecimal-bound, tag-rendered properties, but it is not a drop-everything issue absent POC/KEV evidence.

An unauthenticated attacker locates a public Struts endpoint that binds a parameter to a BigDecimal property later emitted via the Struts tag library. By submitting small requests whose BigDecimal values expand into enormous rendered output, the attacker forces the server to spend disproportionate CPU and outbound bandwidth, degrading or downing the service with sustained low-volume traffic. No public exploit is identified at time of analysis, and the attack requires the specific BigDecimal-binding plus tag-rendering code path to be present.