Is CVE-2026-104712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104712 being exploited in the wild.

How severe is CVE-2026-104712?

Informational severity, published 5 October 2026.

Which products and versions are affected?

Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.

How is CVE-2026-104712 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104712?

Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104712: Apache Struts asymmetric resource consumption in BigDecimal rendering

CVE-2026-104712 · Severity: info · Published 2026-10-05

Apache Struts, a web application framework, contains a vulnerability where requests with specially crafted decimal parameters can trigger responses many orders of magnitude larger than the input. An attacker can exploit this with low-volume traffic to exhaust server CPU and network bandwidth, causing denial of service, but only if the application binds request parameters to BigDecimal properties and renders them through Struts tags.

Technologies: Apache Struts. Vendors: Apache.

Quick answers

Is CVE-2026-104712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104712 being exploited in the wild.
How severe is CVE-2026-104712?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.
Is there a fix for CVE-2026-104712?: Yes: fixed in Struts 6.12.0, 7.4.0. Until then: Register an application-supplied type converter for java.math.BigDecimal that bounds the value's scale before rendering by adding an entry to struts-conversion.properties (or xwork-conversion.properties on the 2.5.x line) in the root of the classpath.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-05"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104712 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104712?: Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Struts 6.12.0, 7.4.0

Register an application-supplied type converter for java.math.BigDecimal that bounds the value's scale before rendering by adding an entry to struts-conversion.properties (or xwork-conversion.properties on the 2.5.x line) in the root of the classpath.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-05"}]

Technical details

The vulnerability is a response amplification (asymmetric resource consumption) issue triggered during type conversion of arbitrary-precision decimal (java.math.BigDecimal) request parameters that are subsequently rendered through the Struts tag library. An unauthenticated remote attacker requires no special privileges; a request parameter binding to a BigDecimal property and tag-based rendering is the only precondition. The attacker gains the ability to consume disproportionate server resources with minimal request traffic. Fixes are available in versions 6.12.0 and 7.4.0.

Affected products

Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.