Summary

Unbounded growth of localized-text caches driven by the request locale causes memory exhaustion (Denial of Service)

Who should read this

All Struts 2 developers and users

Impact of vulnerability

Denial of Service

Maximum security rating

Moderate

Recommendation

Upgrade to Struts 7.3.0 at least, or to Struts 6.11.0 at least on the 6.x maintenance line

Affected Software

  • Struts 2.0.0 through Struts 2.3.37 (EOL)
  • Struts 2.5.0 through Struts 2.5.33 (EOL)
  • Struts 6.0.0 through Struts 6.10.0
  • Struts 7.0.0 through Struts 7.2.1

Reporters

Kuniyoshi Noguchi (野口 晋義), (@KuniNogu)

CVE Identifier

CVE-2026-73635

Problem

Struts performs localized-text lookups to resolve messages such as type-conversion and validation errors. When no fixed locale is configured, the locale used for these lookups is taken from the incoming request. Under this default configuration an unauthenticated remote client can cause the framework's internal localized-text caches to grow without bound, exhausting the Java heap and denying service to other users.

Applications that configure a fixed locale, so that the request-provided locale is not used for message lookups, are not affected.

Solution

Upgrade to Struts 7.3.0 at least. From that release the localized-text caches are bounded, with the maximum size configurable via struts.i18n.cacheMaxSize; request-derived locales can additionally be restricted to the runtime's available-locale set with struts.locale.validateRequestLocale.

Users remaining on the 6.x maintenance line should upgrade to Struts 6.11.0 at least, which carries the same fix.

Backward compatibility

This change is backward compatible. The bounded caches evict entries transparently, and the optional request-locale restriction is disabled by default.

Workaround

Configure a fixed locale by setting the struts.locale constant to a supported value. With a fixed locale configured, localized-text lookups no longer use the request-provided locale, which removes the exposure. Applications that already set struts.locale are not affected.

  • No labels