CVE-2026-104712
CVE-2026-104712 is a high-severity vulnerability with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-405.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- EPSS exploit prediction: 0% (19th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-405
- Published:
- Last modified:
Description
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Frequently asked questions
- What is CVE-2026-104712?
- Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected. This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
- How severe is CVE-2026-104712?
- CVE-2026-104712 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-104712 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-104712?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-104712 published?
- CVE-2026-104712 was published on 2026-10-05 and last updated on 2026-10-06.
References
- https://cwiki.apache.org/confluence/display/WW/S2-076
- http://www.openwall.com/lists/oss-security/2026/10/05/11
Other CWE-405 vulnerabilities
- CVE-2025-53633 — Critical (CVSS 9.8): Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario…
- CVE-2021-38447 — High (CVSS 8.6): OCI OpenDDS versions prior to 3.18.1 are vulnerable when an attacker sends a specially crafted packet to flood target…
- CVE-2025-42874 — High (CVSS 7.9): SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute…
- CVE-2026-104431 — High (CVSS 7.5): Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers…
- CVE-2026-104423 — High (CVSS 7.5): Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers…
- CVE-2026-103880 — High (CVSS 7.5): Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt…