Apache Struts CVE-2026-73634

Exploitation requires that the target application has explicitly implemented and exposed a Content Security Policy violation report collection endpoint built on Apache Struts - this endpoint is not present in the default Struts distribution and must be custom-developed by the application team. The endpoint must be network-reachable by the attacker; because CSP report endpoints are ordinarily unauthenticated (browsers submit violation reports automatically without user credentials), no authentication token or session is required once the endpoint is located. The application must be running an affected version (6.0.0-6.10.0 or 7.0.0-7.2.1). Applications that do not implement this feature, regardless of Struts version, are explicitly not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) accurately reflects the trivial exploitation path once an affected endpoint is publicly reachable, but the critical scoping condition - that the application must have explicitly implemented a CSP report endpoint absent from default Struts distributions - substantially reduces the at-risk population below what the score alone implies; even a mid-sized municipal IT team in mielec running a stock Struts deployment would be unaffected unless they actively built and exposed this feature. EPSS at 0.23% (14th percentile) corroborates that mass exploitation is not currently observed, and no active exploitation appears in the CISA KEV catalog. The realistic risk profile is therefore moderate: high severity for the subset of applications with custom CSP report endpoints, but low ambient exposure across the broader Struts install base.

An attacker discovers a publicly accessible Struts application that exposes a CSP violation report endpoint and sends a single HTTP POST request with an arbitrarily large body to that path. The Struts handler reads the entire payload into heap memory without enforcing a size limit, triggering an OutOfMemoryError or sustained garbage collection pressure that degrades or crashes the JVM, denying service to all concurrent legitimate users. No authentication is required and no public exploit tool has been identified, but the attack is mechanically trivial to reproduce with standard HTTP tooling.