Is CVE-2026-104713 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104713 being exploited in the wild.

How severe is CVE-2026-104713?

Informational severity, published 5 October 2026.

Which products and versions are affected?

Apache Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.

How is CVE-2026-104713 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104713?

Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104713: Apache Struts REST plugin unbounded request body denial of service

CVE-2026-104713 · Severity: info · Published 2026-10-05

Apache Struts is a popular web framework used to build Java web applications. The optional REST plugin in Struts processes incoming request bodies without any limit on size, allowing an attacker to send a large request that consumes all available server memory. This causes the application to become unavailable to legitimate users.

Technologies: Apache Struts. Vendors: Apache.

Quick answers

Is CVE-2026-104713 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104713 being exploited in the wild.
How severe is CVE-2026-104713?: Informational severity, published 5 October 2026.
Which products and versions are affected?: Apache Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.
Is there a fix for CVE-2026-104713?: Yes: fixed in Struts 6.12.0, 7.4.0. Until then: Enforce a maximum request body size ahead of the application, in the reverse proxy or servlet container, for endpoints that accept request bodies. Applications that require larger request bodies can adjust the struts.rest.content.maxLength configuration parameter after upgrading.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-05" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104713 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104713?: Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Struts 6.12.0, 7.4.0

Enforce a maximum request body size ahead of the application, in the reverse proxy or servlet container, for endpoints that accept request bodies. Applications that require larger request bodies can adjust the struts.rest.content.maxLength configuration parameter after upgrading.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-05" } ]

Technical details

The REST plugin reads request bodies into memory without enforcing any upper bound on accepted size, leading to unbounded heap allocation when processing a single request. This affects applications using the REST plugin in its default configuration; no additional settings need to be enabled to expose the vulnerability. The fixed versions implement a default 2 MB limit on request body size, which can be customized via the struts.rest.content.maxLength configuration parameter.

Affected products

Apache Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.