This issue affects Apache Struts: 7.2.1.
Users are recommended to upgrade to version 7.3.0, which fixes the issue.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Struts | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-070 |
|
Sat, 15 Aug 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not enabled by default; applications that do not use the JSON plugin are not affected. This issue affects Apache Struts: 7.2.1. Users are recommended to upgrade to version 7.3.0, which fixes the issue. | |
| Title | Apache Struts: Shared parsing state in the JSON plugin | |
| Weaknesses | CWE-567 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-08-15T10:38:28.497Z
Reserved: 2026-08-13T11:51:27.818Z
Link: CVE-2026-73631
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-15T11:16:27.227
Modified: 2026-08-15T11:16:27.227
Link: CVE-2026-73631
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-15T16:00:07Z
-
CWE-567
Unsynchronized Access to Shared Data in a Multithreaded Context