UpHeron
All vulnerabilities

Servers and applications

CVE-2026-104712

Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and…

Severity
High 7.5
Published
5 Oct 2026
Last changed
8 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.12.0, 7.4.0
Sources
NVD

Affected software

SoftwareAffected versions
Apache StrutsServers and applications · cpe:a:apache:struts
  • From 2.5.14 up to 2.5.33
  • From 6.0.0 before 6.12.0
  • From 7.0.0 before 7.4.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-104712
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-104712