Apache Struts 6.x < 6.11.0 / 7.x < 7.3.0 Multiple Vulnerabilities (S2-072) (S2-074)

high Nessus Plugin ID 338651

Language:

Synopsis

The Apache Struts install on the remote host is affected by multiple denial of service vulnerabilities.

Description

The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is, therefore, affected by multiple denial of service vulnerabilities, as referenced in the S2-072 and S2-074 advisories:

- When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept. A single request can therefore cause the server to allocate memory in proportion to the size of the request, exhausting the heap and denying service to other users. The plugin's configurable limit on JSON input length does not bound this read, so lowering that limit does not reduce exposure. This issue is confined to the JSON plugin, which is an optional component and not part of the Struts core. Applications that do not use the JSON plugin are not affected, and neither are applications that use it without enabling JSON request-body handling, which is not enabled by default. (CVE-2026-73633)

- Struts resolves type-conversion and validation error messages through localized-text lookups. When no fixed locale is configured, the lookup locale is taken from the inbound request, so an unauthenticated remote client can drive the framework's internal localized-text caches to grow without bound and exhaust heap memory. Applications that configure a fixed locale are not affected. (CVE-2026-73635)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache Struts version 6.11.0 / 7.3.0 or later. Alternatively, apply the workaround as referenced in the vendor's security bulletin.

Plugin Details

Severity: High

ID: 338651

File Name: struts_6_11_0.nasl

Version: 1.2

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 8/21/2026

Updated: 8/21/2026

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

Percentile: 96.41

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-73633

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-73635

Vulnerability Information

CPE: cpe:/a:apache:struts

Required KB Items: Settings/ParanoidReport, Host/OS, installed_sw/Apache Struts

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/1/2026

Vulnerability Publication Date: 7/28/2026

Reference Information

CVE: CVE-2026-73633, CVE-2026-73635

IAVA: 2026-A-0858

Detections

Analytics