Race Condition Vulnerability in Apache Struts Affects Multiple Versions
CVE-2026-104714

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Struts
Vendor
CVE Published:
5 October 2026

What is CVE-2026-104714?

A race condition vulnerability exists in Apache Struts due to improper synchronization when handling localized messages that format date or time arguments. This flaw allows concurrent requests to interfere with each other, potentially exposing user-specific data in responses. Applications that format no date or time arguments remain unaffected. It is essential to upgrade to versions 6.12.0 or 7.4.0 to mitigate this issue effectively.

Affected Version(s)

Apache Struts 2.0.0 <= 2.3.37

Apache Struts 2.5.0 <= 2.5.33

Apache Struts 6.0.0 <= 6.11.0

References

https://cwiki.apache.org/confluence/display/WW/S2-078
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

n0mi1k
.