Summary

Unbounded read of a JSON request body

Who should read this

All Struts 2 developers and users of the JSON plugin

Impact of vulnerability

Denial of Service

Maximum security rating

Moderate

Recommendation

Upgrade to Struts 7.3.0 at least, or to Struts 6.11.0 at least on the 6.x maintenance line

Affected Software

  • Struts 2.1.8 through 2.3.37 (EOL)
  • Struts 2.5.0 through 2.5.33 (EOL)
  • Struts 6.0.0 through 6.10.0
  • Struts 7.0.0 through 7.2.1

Earlier releases do not bundle the JSON plugin and are not affected.

Reporters

Michael Mullins

CVE Identifier

CVE-2026-73633

Problem

When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept. A single request can therefore cause the server to allocate memory in proportion to the size of the request, exhausting the heap and denying service to other users.

The plugin's configurable limit on JSON input length does not bound this read, so lowering that limit does not reduce exposure.

This issue is confined to the JSON plugin, which is an optional component and not part of the Struts core. Applications that do not use the JSON plugin are not affected, and neither are applications that use it without enabling JSON request-body handling, which is not enabled by default.

Solution

Upgrade to Struts 7.3.0 at least.

Users remaining on the 6.x maintenance line should upgrade to Struts 6.11.0 at least, which carries the same fix.

Backward compatibility

No configuration or application changes are required.

One behavioural difference is worth noting: an unescaped control character appearing inside a JSON string value is now preserved in the parsed value instead of being silently discarded. Such input is not valid JSON, and an application relying on the previous silent removal may observe different values.

Workaround

There is no configuration-only mitigation for this issue. In particular, lowering the configured JSON input length limit does not bound the read.

Users unable to upgrade immediately should enforce a maximum request body size ahead of the application, in the reverse proxy or the servlet container, for endpoints that accept JSON request bodies.

  • No labels