What is the CVSS score of EUVD-2026-58662?

EUVD-2026-58662 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache Struts are affected by EUVD-2026-58662?

A high-severity denial-of-service vulnerability in Apache Struts' JSON plugin (CVE-2026-73633) allows unauthenticated attackers to crash exposed web services by sending oversized HTTP requests.

How to fix or mitigate EUVD-2026-58662?

Within 24 hours: Inventory all systems running Apache Struts and identify endpoints where request-body-to-action population is enabled. Immediately implement network-level rate limiting and Web Application Firewall rules to reject HTTP requests with oversized JSON bodies (define threshold below your normal max payload size). Within 7 days: Deploy application-level request size limits and, where operationally feasible, disable the JSON plugin or request-body-to-action feature if not essential to business function. Within 30 days: Monitor Apache Struts security advisories for patch availability; develop a phased upgrade strategy to Struts versions that address this issue once released, prioritizing externally exposed endpoints.

Apache Struts EUVD-2026-58662

| CVE-2026-73633 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-14 security@apache.org

GHSA-335q-cpqh-m68h

Apache Denial Of Service Struts

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, no credentials needed, single crafted request sufficient; pure availability impact with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 16:31 vuln.today

CVSS changed

Aug 14, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Aug 14, 2026 - 14:16 cve.org

HIGH 7.5

CVE Published

Aug 14, 2026 - 14:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The JSON plugin is an optional component; applications that do not use it, or use it without enabling JSON request-body handling, are not affected.

This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

AnalysisAI

Heap exhaustion via unbounded JSON body reading in the Apache Struts JSON plugin allows unauthenticated remote attackers to deny service by sending a single oversized HTTP request to any endpoint where request-body-to-action population is enabled. Affected version ranges span the 2.x, 6.x, and 7.x release lines. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify Struts JSON endpoint

Delivery

Craft oversized JSON POST body

Exploit

Submit request to vulnerable endpoint

Execution

Plugin reads body unbounded into JVM heap

Persist

Heap exhaustion triggers OOM

Impact

Application denies service to all users

Access

Identify Struts JSON endpoint

Delivery

Craft oversized JSON POST body

Exploit

Submit request to vulnerable endpoint

Execution

Plugin reads body unbounded into JVM heap

Persist

Heap exhaustion triggers OOM

Impact

Application denies service to all users

Vulnerability AssessmentAI

Exploitation	Two specific conditions must both be met: (1) the Apache Struts JSON plugin must be included as a dependency in the application - it is an optional component and is not present in all Struts deployments; and (2) the application must be explicitly configured to populate action objects from a JSON request body (the feature that triggers the unbounded read). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 7.5 (High), reflecting a straightforward, unauthenticated network attack with no complexity requirements. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker identifies a publicly accessible Apache Struts endpoint that processes JSON request bodies - discoverable via fingerprinting or by probing for characteristic Struts URL patterns. The attacker sends a single HTTP POST request containing an extremely large JSON payload; the JSON plugin reads the entire body into JVM heap memory before any length check applies. …
Remediation	Upgrade Apache Struts to version 6.11.0 (for 6.x deployments) or 7.3.0 (for 7.x deployments), which fix the unbounded read. … Detailed patch versions, workarounds, and compensating controls in full report.