Race Condition Vulnerability in Apache Struts Affects Multiple Versions

CVE-2026-104714

What is CVE-2026-104714?

A race condition vulnerability exists in Apache Struts due to improper synchronization when handling localized messages that format date or time arguments. This flaw allows concurrent requests to interfere with each other, potentially exposing user-specific data in responses. Applications that format no date or time arguments remain unaffected. It is essential to upgrade to versions 6.12.0 or 7.4.0 to mitigate this issue effectively.

References