Data Exposure Vulnerability in JSON Plugin of Apache Struts

CVE-2026-73632

What is CVE-2026-73632?

The JSON plugin in Apache Struts contains a vulnerability that allows data associated with one session to be exposed to another. This arises from the way per-response serialization state can be inadvertently shared across concurrent requests, affecting only the SMD/JSON-RPC handling of the JSON interceptor, which is not enabled by default. Applications utilizing the json result type remain unaffected. To mitigate this issue, users are urged to upgrade to version 7.3.0, which addresses the vulnerability.

References