Apache Struts: Unbounded growth of localized-text caches driven by the request locale
Published Aug 15, 2026
7.5
HIGHCVSS 3.1
EPSS 0.70%
Description
Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text lookups is taken from the incoming request, allowing an unauthenticated remote client to cause the framework's internal localized-text caches to grow without bound and exhaust the Java heap, denying service to other users. Applications that configure a fixed locale are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, from 7.0.0 through 7.2.1.
Users are recommended to upgrade to version 6.11.0 or 7.3.0, which fixes the issue.
Affected products
-
- Version 2.0.0StatusaffectedConstraints<=2.3.37
- Version 2.5.0StatusaffectedConstraints<=2.5.33
- Version 6.0.0StatusaffectedConstraints<=6.10.0
- Version 7.0.0StatusaffectedConstraints<=7.2.1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | unaffected |
|
No data.
Red Hat Enterprise Linux 10
google-guice
Not affected
Red Hat Enterprise Linux 8
javapackages-tools:201801/google-guice
Not affected
Red Hat Enterprise Linux 9
google-guice
Not affected
Red Hat Enterprise Linux 9
maven:3.9/google-guice
Not affected
Red Hat Fuse 7
struts2-core
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 10 | google-guice | Not affected | n/a |
| Red Hat Enterprise Linux 8 | javapackages-tools:201801/google-guice | Not affected | n/a |
| Red Hat Enterprise Linux 9 | google-guice | Not affected | n/a |
| Red Hat Enterprise Linux 9 | maven:3.9/google-guice | Not affected | n/a |
| Red Hat Fuse 7 | struts2-core | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
An uncontrolled resource consumption flaw exists in the Apache Struts localized-text lookup caching mechanism. When no fixed application locale is configured, incoming HTTP request headers dynamically set the lookup locale, allowing the internal text cache to grow without bound. An unauthenticated remote attacker can exploit this by streaming requests with arbitrary, unique locale parameters, exhausting JVM heap space and causing a denial of service. The impact is limited to process availability.
Red Hat mitigation
Configure a fixed default locale in `struts.xml` by setting the `struts.locale` property (e.g., `<constant name="struts.locale" value="en_US" />`). Alternatively, configure an API gateway or web application firewall (WAF) to sanitize or strip non-standard `Accept-Language` headers before forwarding traffic to the application.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Aug 17, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Aug–Oct 2026- EPSS v5
Percentile over time
- EPSS v5
Table of values (2 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.70% (0.00698) | 51.32th | v5 (v2026.06.15) |
| Aug 16, 2026 | 0.19% (0.00190) | 9.00th | v5 (v2026.06.15) |
References (5)
- https://access.redhat.com/security/cve/CVE-2026-73635 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2516947 Issue Tracking
- https://cwiki.apache.org/confluence/display/WW/S2-074 vendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73635
- https://www.cve.org/CVERecord?id=CVE-2026-73635
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-73635 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2516947 | Issue Tracking | |
| https://cwiki.apache.org/confluence/display/WW/S2-074 | vendor-advisoryVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-73635 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-73635 |
Change history (0)
No recorded changes yet.