CVE-2026-73635

A flaw was found in Apache Struts. An unauthenticated remote client can exploit a vulnerability where the framework's localized-text caches grow without bound. This occurs when no fixed locale is configured, and the locale for text lookups is derived from the incoming request. This can lead to the exhaustion of Java heap memory, resulting in a Denial of Service (DoS) for other users.

An uncontrolled resource consumption flaw exists in the Apache Struts localized-text lookup caching mechanism. When no fixed application locale is configured, incoming HTTP request headers dynamically set the lookup locale, allowing the internal text cache to grow without bound. An unauthenticated remote attacker can exploit this by streaming requests with arbitrary, unique locale parameters, exhausting JVM heap space and causing a denial of service. The impact is limited to process availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.