CVE-2026-104712

Apache Struts can produce a response many orders of magnitude larger than the request when an attacker-controlled request parameter is bound to a java.math.BigDecimal property and that property is rendered through the Struts tag library. An unauthenticated remote attacker can use sustained, low-volume requests to exhaust server CPU and outbound network capacity, causing denial of service. Applications that do not use this binding-and-rendering path are not affected.

An unauthenticated remote attacker can cause denial of service when an application binds attacker-controlled request parameters to a java.math.BigDecimal property and renders that property through the Struts tag library. Disproportionate response expansion can consume server CPU and outbound network capacity. The impact is limited to availability; confidentiality and integrity are not affected. Applications that do not use this binding-and-rendering path are not affected. JSON and REST plugin responses and properties using other numeric types are outside the affected path. Red Hat rates this vulnerability Important (CVSS 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting its unauthenticated, low-complexity network attack path and high availability impact. Apache rates the issue Moderate.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.