CVE-2026-73635

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73635
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73635.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73635
Published
2026-08-15T10:38:08Z
Modified
2026-08-20T03:30:16Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Struts: Unbounded growth of localized-text caches driven by the request locale
Details

Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.

This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.

Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73635.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.3.37"
                },
                {
                    "introduced": "2.5.0"
                },
                {
                    "last_affected": "2.5.33"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "last_affected": "6.10.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.2.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.3.37"
                },
                {
                    "introduced": "2.5.0"
                },
                {
                    "fixed": "2.5.33"
                },
                {
                    "introduced": "6.0.0"
                },
                {
                    "fixed": "6.10.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.2.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts
Events
Introduced
2c0a197cea8fdc7d8cda5eeaa15a1c76507ac0a5
Last Affected
60a1a2642ae7ddf74c0062fe37b3b57f83a0588e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ca8d57c538136983a0180ac508ebcfabaf73f839
Introduced
68fb49c10e083dce829476778eec726fc90c8c38
Fixed
52628432a922c87dcbb87241b0f749ee5cfc489f
Introduced
1d95543fbf2c873d5dab1773f951c38e3220b4e5
Fixed
a88fd76364b8a88a8769455675ceeb8acd256d5b
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.3.37"
        },
        {
            "introduced": "2.5.0"
        },
        {
            "last_affected": "2.5.33"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.11.0"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.3.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

Other
STRUTS_2_3_24
STRUTS_2_3_24_1
STRUTS_2_3_25
STRUTS_2_3_26
STRUTS_2_3_27
STRUTS_2_3_28
STRUTS_2_3_29
STRUTS_2_3_30
STRUTS_2_3_31
STRUTS_2_3_32
STRUTS_2_3_33
STRUTS_2_3_34
STRUTS_2_3_35
STRUTS_2_3_36
STRUTS_2_3_37
STRUTS_2_5_10
STRUTS_2_5_11
STRUTS_2_5_12
STRUTS_2_5_13
STRUTS_2_5_14
STRUTS_2_5_14_1
STRUTS_2_5_15
STRUTS_2_5_16
STRUTS_2_5_17
STRUTS_2_5_18
STRUTS_2_5_19
STRUTS_2_5_20
STRUTS_2_5_21
STRUTS_2_5_22
STRUTS_2_5_23
STRUTS_2_5_24
STRUTS_2_5_25
STRUTS_2_5_26
STRUTS_2_5_27
STRUTS_2_5_28
STRUTS_2_5_28_1
STRUTS_2_5_28_2
STRUTS_2_5_28_3
STRUTS_2_5_29
STRUTS_2_5_3
STRUTS_2_5_30
STRUTS_2_5_31
STRUTS_2_5_32
STRUTS_2_5_33
STRUTS_2_5_4
STRUTS_2_5_5
STRUTS_2_5_6
STRUTS_2_5_7
STRUTS_2_5_8
STRUTS_2_5_9
STRUTS_2_5_BETA1
STRUTS_2_5_BETA2
STRUTS_6_0_0
STRUTS_6_0_1
STRUTS_6_0_2
STRUTS_6_0_3
STRUTS_6_1_0
STRUTS_6_1_1
STRUTS_6_2_0
STRUTS_6_3_0
STRUTS_6_3_0_1
STRUTS_6_4_0
STRUTS_6_5_0
STRUTS_6_6_0
STRUTS_6_6_1
STRUTS_6_7_0
STRUTS_6_7_1
STRUTS_6_7_2
STRUTS_6_7_3
STRUTS_6_7_4
STRUTS_6_8_0
STRUTS_7_0_0
STRUTS_7_0_1
STRUTS_7_0_2
STRUTS_7_0_3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73635.json"