Asymmetric Resource Consumption Vulnerability in Apache Struts

CVE-2026-104712

What is CVE-2026-104712?

An asymmetric resource consumption vulnerability exists in Apache Struts due to improper handling of request parameters bound to arbitrary-precision decimal properties. This issue allows an unauthenticated remote attacker to generate responses that can drastically exceed the initial request size, potentially consuming excessive server CPU and network bandwidth. Applications that do not leverage BigDecimal properties through the Struts tag library remain unexposed. Users are advised to upgrade to Apache Struts version 6.12.0 or 7.4.0 to mitigate the risk.

References