{"id":"CVE-2026-104712","published":"2026-10-05T19:17:14.630","lastModified":"2026-10-08T19:11:24.190","description":"Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\n\nThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-405"],"vendors":["apache"],"products":["struts"],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-076","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/11","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Apache Struts suffers from an asymmetric resource consumption vulnerability where requests bound to BigDecimal properties can generate responses orders of magnitude larger than the original request, allowing attackers to exhaust server resources with minimal traffic. This affects versions from 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0.","exploitability":"Exploitation is relatively straightforward requiring only unauthenticated access to a Struts application with BigDecimal parameter binding, but requires the specific combination of request parameter binding and tag library rendering to trigger the amplification effect.","blast_radius":"If exploited, this vulnerability could cause significant CPU and network resource exhaustion on affected servers, potentially leading to denial of service for legitimate users while consuming minimal attacker bandwidth.","remediation":"Upgrade to Apache Struts 6.12.0 or 7.4.0 immediately to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["denial-of-service","resource-consumption","struts","java"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:03:20.912Z"}}