{"id":"CVE-2026-104714","published":"2026-10-05T19:17:14.883","lastModified":"2026-10-08T19:16:14.527","description":"Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-362"],"vendors":["apache"],"products":["struts"],"references":[{"url":"https://cwiki.apache.org/confluence/display/WW/S2-078","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/05/13","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw involves a race condition in Apache Struts where concurrent execution using shared resources without proper synchronization can lead to localized message formatting issues, potentially exposing user data or causing server errors.","exploitability":"Exploitation requires concurrent access to the affected feature, making it moderately difficult. Precondition is the presence of concurrent requests using shared resources.","blast_radius":"If exploited, this could lead to data exposure or server errors affecting multiple users, impacting application integrity and user trust.","remediation":"Upgrade to Apache Struts version 6.12.0 or 7.4.0, which address the issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["race-condition","web","struts"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:44:16.420Z"}}