Uncontrolled Resource Consumption Vulnerability in Apache Struts by Apache

CVE-2026-73634

What is CVE-2026-73634?

An uncontrolled resource consumption issue exists in Apache Struts, allowing applications that expose endpoints to collect Content Security Policy violation reports to read submitted reports into memory without limitations. This vulnerability permits a single request to consume excessive heap memory, potentially leading to denial of service for other users. Such endpoints are typically accessible without authentication. The core distribution of Apache Struts does not include this endpoint by default, so applications that don't collect violation reports are not impacted. Users are encouraged to upgrade to version 6.11.0 or 7.3.0 to mitigate this vulnerability.

References