CVE-2026-104712

Summary

Apache Struts suffers from an asymmetric resource consumption vulnerability where requests bound to BigDecimal properties can generate responses orders of magnitude larger than the original request, allowing attackers to exhaust server resources with minimal traffic. This affects versions from 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.

Exploitability

Exploitation is relatively straightforward requiring only unauthenticated access to a Struts application with BigDecimal parameter binding, but requires the specific combination of request parameter binding and tag library rendering to trigger the amplification effect.

Blast radius

If exploited, this vulnerability could cause significant CPU and network resource exhaustion on affected servers, potentially leading to denial of service for legitimate users while consuming minimal attacker bandwidth.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache Struts 6.12.0 or 7.4.0 immediately to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.