Apache Struts CVE-2026-73633

Two specific conditions must both be met: (1) the Apache Struts JSON plugin must be included as a dependency in the application - it is an optional component and is not present in all Struts deployments; and (2) the application must be explicitly configured to populate action objects from a JSON request body (the feature that triggers the unbounded read). Applications using the JSON plugin only for other purposes (e.g., JSON result rendering) without enabling request-body-to-action mapping are not affected. What limits exploitation: non-default configuration requirement (the JSON request-body feature must be deliberately enabled), no cross-application scope change, and availability-only impact. What does NOT limit exploitation: no authentication is required per CVSS PR:N, attack complexity is low, and SSVC rates the attack as automatable, meaning no specialized tooling is needed beyond crafting a large HTTP POST body.

The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 (High), reflecting a straightforward, unauthenticated network attack with no complexity requirements. However, the real-world exposure is narrowed by an important deployment condition: only applications that explicitly use the JSON plugin and enable request-body population are vulnerable - the plugin is optional and disabled by default in many deployments. SSVC rates exploitation as 'none' with 'automatable: yes' and 'technical impact: partial', meaning while no active campaigns are observed, an attacker could trivially automate requests against exposed endpoints. No EPSS data was provided in the input; absent that signal, the automatable SSVC rating and absence from CISA KEV together suggest elevated theoretical risk but no confirmed active exploitation pressure at this time. Impact is availability-only - there is no confidentiality or integrity exposure - limiting the blast radius to service disruption rather than data compromise or lateral movement.

An attacker identifies a publicly accessible Apache Struts endpoint that processes JSON request bodies - discoverable via fingerprinting or by probing for characteristic Struts URL patterns. The attacker sends a single HTTP POST request containing an extremely large JSON payload; the JSON plugin reads the entire body into JVM heap memory before any length check applies. Repeated requests, or a single sufficiently large payload, exhaust available heap space, triggering OutOfMemoryError conditions and rendering the application unavailable to legitimate users. No public exploit code has been identified at time of analysis.