CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected. This issue affects Apache Struts: 7.2.1. Users are recommended to upgrade to version 7.3.0, which fixes the issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cwiki.apache.org/confluence/display/WW/S2-070	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:struts:7.2.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-08-15 11:16

Updated : 2026-08-18 17:47

NVD link : CVE-2026-73631

Mitre link : CVE-2026-73631

CVE.ORG link : CVE-2026-73631

JSON object : View

Products Affected

apache

struts

CWE

CWE-567

Unsynchronized Access to Shared Data in a Multithreaded Context

{"id": "CVE-2026-73631", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73631", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-17T12:42:07.654513Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Struts", "versions": [{"status": "affected", "version": "7.2.1", "versionType": "semver"}], "packageName": "org.apache.struts:struts2-json-plugin", "defaultStatus": "unaffected"}]}], "published": "2026-08-15T11:16:27.227", "references": [{"url": "https://cwiki.apache.org/confluence/display/WW/S2-070", "tags": ["Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-567"}]}], "descriptions": [{"lang": "en", "value": "Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected.\n\nThis issue affects Apache Struts: 7.2.1.\n\nUsers are recommended to upgrade to version 7.3.0, which fixes the issue."}], "lastModified": "2026-08-18T17:47:40.480", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:struts:7.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B413DED-A87F-4793-A0DC-7D11B1C7A6BE"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}