The essentials
- On 9 October 2026, CERT-FR issued advisory CERTFR-2026-AVI-1290 covering four Apache Struts bulletins dated 2 October (S2-075 through S2-078), with remote code execution, denial of service, and data confidentiality risks.
- Struts 6.x releases before 6.12.0 and 7.x before 7.4.0 are in scope; the vendor states Struts 2 is no longer maintained.
- S2-075 (CVE-2026-104711) affects the legacy RESTful action mapper via OGNL injection; S2-077 (CVE-2026-104713) leaves the REST plugin exposed to unbounded request bodies (memory DoS).
- S2-078 (CVE-2026-104714) describes possible leakage between users through concurrent date/time formatting in localized messages—without a targeted attack.
What CERT-FR reports
On 9 October 2026, France’s CERT-FR published advisory CERTFR-2026-AVI-1290 on multiple vulnerabilities in Apache Struts, referencing four vendor bulletins from 2 October 2026 (S2-075 through S2-078). The official summary lists remote arbitrary code execution, remote denial of service, and data confidentiality impact. Versions 6.x before 6.12.0 and 7.x before 7.4.0 are affected. The vendor notes that Struts 2 is no longer maintained.
RCE and DoS: legacy mapper, BigDecimal, REST plugin
S2-075 (CVE-2026-104711) : if the app uses the legacy RESTful action mapper, a crafted request can inject an OGNL expression and lead to remote code execution. Apps on the default mapper, the `restful2` mapper, or the REST plugin are not affected. On Struts 7, the default configuration with the OGNL allowlist enabled is not exposed.
S2-076 (CVE-2026-104712) : when a parameter binds to a `java.math.BigDecimal` property and is rendered through the tag library, the response can expand far beyond the request — DoS on CPU and outbound bandwidth, with no authentication. JSON/REST plugin responses are not affected.
S2-077 (CVE-2026-104713), rated Important by Apache : with the REST plugin, the request body is read into memory with no upper bound; one large request can exhaust the heap. Fixed releases cap bodies at 2 MB by default (`struts.rest.content.maxLength`). Until you patch, Apache advises enforcing body size at the reverse proxy or servlet container.
Confidentiality: localized messages under concurrency
S2-078 (CVE-2026-104714) : the shared text provider reuses a formatter across concurrent requests. If your i18n message formats a date or time, two simultaneous users may see another session’s value in the page, or trigger a server error. No malicious request is required — normal traffic is enough. Struts-shipped bundles do not format dates; exposure comes from application-owned message files.
- Inventory : Maven/Gradle dependencies, legacy WARs, Java microservices still on Struts 6.x/7.x.
- Single target : plan Struts 6.12.0+ or 7.4.0+ to cover all four bulletins.
- Legacy RESTful mapper : move to the REST plugin or default mapper (S2-075).
- REST endpoints : confirm max body size after patching; tune `struts.rest.content.maxLength` if legitimate payloads exceed 2 MB.
- i18n messages : pre-format dates/times before interpolation if you cannot patch immediately (vendor workaround for S2-078).
Sources
This note was drafted with AI tools from the cited sources, then reviewed and published under the responsibility of Jordan FOUASSIER, publication director. We summarise the facts and add our reading; source text and images are not reproduced. An error? Write to contact@aigyrosgroup.com.