Apache Struts has released fixes for four vulnerabilities, including one that allows unauthenticated remote code execution when the legacy RESTful mapper is enabled.
The flaw, identified as CVE-2026-104711, is an OGNL injection that depends on the application using the deprecated RESTful mapper. Applications running the default mapper, restful2, or the official Struts REST plugin are not affected. In version 7.x the issue only manifests when the OGNL allow-list is disabled.
When the legacy mapper is active, it extracts action names and parameters straight from the URL. Attackers can therefore supply a malicious OGNL expression that is evaluated by the framework, leading to arbitrary code execution.
Affected versions include 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Patches are available in 6.12.0 and 7.4.0 and later releases.
The three additional vulnerabilities do not result in code execution. Two affect availability: one causes small requests to generate disproportionately large responses, consuming CPU and bandwidth, while the other exhausts memory by accepting unbounded request bodies. The memory-exhaustion issue received an “important” severity rating and now enforces a default limit of 2,097,152 characters.
The fourth flaw is subtler and does not require malicious input. Shared message formatters can interfere between concurrent requests, potentially leaking data or producing rendering errors under normal traffic.
