EUVD-2026-59604
GHSA-prrh-5r25-ch75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP requests with synthesized unique locale values
-
DeliveryFramework resolves locale from request (no fixed locale configured)
-
ExploitNew cache entry allocated per unique locale
-
ExecutionHeap consumption grows without eviction bound
-
PersistJVM OutOfMemoryError triggers
-
ImpactApplication unavailable to legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The application must NOT have a fixed locale explicitly configured - that is, the struts.locale property must be absent or unset in struts.xml or struts.properties, leaving locale resolution to per-request data. This is the sole required condition and eliminates all affected versions where fixed-locale configuration is in place. Limiting factors: the vulnerability affects only the locale-cache code path, so applications configured with struts.locale are completely immune regardless of version; exploitation requires sustained request volume sufficient to exhaust heap before the application or container enforces memory limits; the JVM heap size and garbage collection policy influence how quickly exhaustion occurs. Authentication is not required (PR:N). The vulnerability is not exploitable on affected versions that have configured a fixed locale. |
| Impact | The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H correctly reflects a remotely exploitable, unauthenticated DoS - the highest-risk profile for availability impact. However, the real-world risk is modulated by the critical deployment condition: only applications without a fixed locale configured are vulnerable. EPSS at 0.19% (9th percentile) is low, indicating that exploitation has not been widely observed in the wild, and the vulnerability is not listed in the CISA KEV catalog. There is no reported POC. The impact is limited to availability - confidentiality and integrity are unaffected, limiting the blast radius compared to RCE vulnerabilities of similar CVSS score. For organizations running Apache Struts without explicit locale configuration and with internet-facing endpoints, this is a genuine priority given the ease of triggering the condition (simple HTTP requests). For those with fixed-locale deployments, risk is negligible. The conflict between high CVSS and low EPSS is consistent with a DoS class vulnerability: technically easy to exploit but less operationally useful to attackers than RCE. |
| Exploit ScenarioDerived | An attacker targeting an internet-facing Apache Struts application without fixed locale configuration sends a flood of HTTP GET or POST requests, each specifying a distinct synthetic locale value (e.g., xx-YY, zz-WW) in the Accept-Language header or locale request parameter. Each unique value causes Struts to allocate and cache a new localized-text lookup entry. With no eviction or size limit, the cache grows until the JVM heap is exhausted, at which point the application throws OutOfMemoryError, rendering it unavailable to legitimate users. No authentication or application-specific knowledge is required beyond knowledge of the locale parameter path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 17, 2026
Unbounded locale cache growth in Apache Struts allows unauthenticated remote attackers to exhaust JVM heap memory and deny service to all users of the application. The vulnerability spans an exceptionally wide version range - from 2.0.0 through 7.2.1 across four release branches - and is exploitable only when no fixed locale is configured, a condition common in multilingual deployments. No public exploit has been identified at time of analysis, and EPSS at 0.19% (9th percentile) reflects low observed exploitation activity; however, the network vector with zero prerequisites on vulnerable configurations makes this a meaningful DoS risk in exposed environments.
RemediationAI
Upgrade to Apache Struts 6.11.0 or 7.3.0, the vendor-confirmed fixed releases per the Apache security advisory S2-074 at https://cwiki.apache.org/confluence/display/WW/S2-074. Note that the 2.x branch (2.3.37 and 2.5.33) does not appear to have a corresponding fix release - organizations running the 2.x branch should migrate to the 6.x or 7.x line. For deployments that cannot immediately upgrade, the complete and effective workaround is to configure a fixed locale in the application's struts.xml or struts.properties via the struts.locale property (e.g., struts.locale=en_US). This eliminates the attack vector entirely because the cache is populated only once with the fixed locale rather than dynamically per request. The trade-off is loss of dynamic locale selection, which impacts multilingual user experiences; evaluate against operational requirements before applying. Rate-limiting or WAF rules targeting unusual Accept-Language header diversity may provide partial mitigation but are not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Struts is a widely-used Java MVC framework that maintains internal caches for localized text lookups (i18n/l10n message bundles). When locale resolution is delegated to the incoming HTTP request - typically via the Accept-Language header or a request parameter - the framework creates and stores a new cache entry for each unique locale value encountered. CWE-770 (Allocation of Resources Without Limits or Throttling) describes this root cause precisely: there is no upper bound on the number of distinct cache entries, no eviction policy, and no rate limit on cache population. An attacker can drive this cache to consume all available JVM heap, triggering OutOfMemoryError and crashing or stalling the application server. Affected CPEs span Apache Struts 2.0.0-2.3.37, 2.5.0-2.5.33, 6.0.0-6.10.0, and 7.0.0-7.2.1.
Know when Struts gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-delivered DoS via locale-manipulated HTTP requests; no authentication or complexity beyond sustained request volume; impact confined to availability with no confidentiality or integrity loss.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Executive ViewAI
Apache Struts versions 2.0.0 through 7.2.1 are vulnerable to denial-of-service attacks affecting any organization with multilingual web applications, creating immediate application downtime risk. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; remediation requires architectural changes rather than straightforward updates. The affected version range is exceptionally broad, meaning the majority of active Struts deployments require urgent mitigation action.
Disable dynamic locale negotiation by configuring a fixed locale; restrict network access to vulnerable systems via firewall rules or network segmentation; implement HTTP rate limiting on requests containing locale parameters; deploy JVM heap utilization monitoring with alerting; maintain detailed security audit logs to support incident investigation and forensics if DoS occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with a
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, a
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in o
ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which all
In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag in
Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not
The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers
Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute
Exploit-DB