Data Exposure Vulnerability in JSON Plugin of Apache Struts
CVE-2026-73632

4.3MEDIUM

Key Information:

Vendor

Apache
Status
Apache Struts
Vendor
CVE Published:
15 August 2026

What is CVE-2026-73632?

The JSON plugin in Apache Struts contains a vulnerability that allows data associated with one session to be exposed to another. This arises from the way per-response serialization state can be inadvertently shared across concurrent requests, affecting only the SMD/JSON-RPC handling of the JSON interceptor, which is not enabled by default. Applications utilizing the json result type remain unaffected. To mitigate this issue, users are urged to upgrade to version 7.3.0, which addresses the vulnerability.

Affected Version(s)

Apache Struts 7.2.1

References

https://cwiki.apache.org/confluence/display/WW/S2-071
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

g0w6y (https://github.com/g0w6y)
.