Asymmetric Resource Consumption (Amplification) Affecting org.apache.struts:struts2-core package, versions [,6.12.0)[7.0.0,7.4.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGAPACHESTRUTS-21816516
- published29 Oct 2026
- disclosed5 Oct 2026
- credit0xCc.zhang
Introduced: 5 Oct 2026
NewCVE-2026-104712 (opens in a new tab)How to fix?
Upgrade org.apache.struts:struts2-core to version 6.12.0, 7.4.0 or higher.
Overview
org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.
Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) in the convertToString method of the StringConverter class, which calls format.setMaximumFractionDigits(Integer.MAX_VALUE) for BigDecimal, Double, and Float values. An attacker can exhaust server CPU and outbound network capacity with sustained low-volume traffic by sending a short decimal value, such as a BigDecimal with a very large scale, to a request parameter bound to a java.math.BigDecimal property that is then rendered through the Struts tag library, producing a response many orders of magnitude larger than the request. Exploitation requires the application to bind a request parameter to a BigDecimal property and render that property through the Struts tag library. Responses produced by the JSON plugin and the REST plugin are not affected, and properties of other numeric types including double, float, long, and int are not affected.
Workaround
This vulnerability can be avoided by registering an application-supplied type converter for java.math.BigDecimal that bounds the value's scale before rendering, via an entry in struts-conversion.properties at the root of the classpath (typically WEB-INF/classes), or xwork-conversion.properties in 2.5.x versions.