Summary

Shared parsing state in the JSON plugin

Who should read this

All Struts 2 developers and users of the JSON plugin

Impact of vulnerability

Disclosure of Data, Data Integrity, Bypass of a configured limit

Maximum security rating

Moderate

Recommendation

Upgrade to Struts 7.3.0 at least

Affected Software

  • Struts 7.2.1

Reporters

g0w6y - https://github.com/g0w6y

CVE Identifier

CVE-2026-73631

Problem

A component of the JSON plugin that holds per-request parsing state could be shared between requests instead of being used by a single request at a time. When requests are processed concurrently, that state is not isolated, which can lead to data associated with one request becoming observable in another, and to configured parsing limits not being enforced as intended.

Applications that do not use the JSON plugin are not affected. Within the plugin, the affected handling is the population of actions from a JSON request body, which is not enabled by default. Earlier releases are not affected.

Solution

Upgrade to Struts 7.3.0 at least.

Backward compatibility

This change is backward compatible.

Workaround

Applications that do not use the JSON plugin, or that do not populate actions from JSON request bodies, are not affected and no action is required.

For affected applications there is no configuration-only mitigation. Upgrading to Struts 7.3.0 is the recommended action.

  • No labels