Summary

Shared serialization state in the JSON plugin

Who should read this

All Struts 2 developers and users of the JSON plugin

Impact of vulnerability

Disclosure of Data, Data Integrity

Maximum security rating

Low

Recommendation

Upgrade to Struts 7.3.0 at least

Affected Software

  • Struts 7.2.1

Reporters

g0w6y - https://github.com/g0w6y

CVE Identifier

CVE-2026-73632

Problem

A component of the JSON plugin that holds per-response serialization state could be shared between requests instead of being used by a single request at a time. When requests are processed concurrently, that state is not isolated, which can lead to response content associated with one request becoming observable in another.

Applications that do not use the JSON plugin are not affected. Within the plugin, this affects only the SMD / JSON-RPC handling of the JSON interceptor, which is not enabled by default. Applications using the json result type are not affected, as a separate writer is used for each request. Earlier releases are not affected.

Solution

Upgrade to Struts 7.3.0 at least.

Backward compatibility

This change is backward compatible.

Workaround

Applications that do not use the JSON plugin, and applications that use only the json result type, are not affected and no action is required.

Users unable to upgrade immediately can leave SMD support disabled on the JSON interceptor, which is the default:

<interceptor-ref name="json">
    <param name="enableSMD">false</param>
</interceptor-ref>
  • No labels