# CVE-2026-104713: Apache Struts REST plugin unbounded request body denial of service

Source: https://junglewise.ai/threats/cve-2026-104713-allocation-of-resources-without-limits-or-throttling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104713 · Severity: info · Published 2026-10-05

Apache Struts is a popular web framework used to build Java web applications. The optional REST plugin in Struts processes incoming request bodies without any limit on size, allowing an attacker to send a large request that consumes all available server memory. This causes the application to become unavailable to legitimate users.

Technologies: [Apache Struts](https://junglewise.ai/threats/technologies/struts). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-104713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104713 being exploited in the wild.

**How severe is CVE-2026-104713?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Apache Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0.

**Is there a fix for CVE-2026-104713?** Yes: fixed in Struts 6.12.0, 7.4.0. Until then: Enforce a maximum request body size ahead of the application, in the reverse proxy or servlet container, for endpoints that accept request bodies. Applications that require larger request bodies can adjust the struts.rest.content.maxLength configuration parameter after upgrading.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-05"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104713 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104713?** Check whether you run Apache Struts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Struts 6.12.0, 7.4.0

Enforce a maximum request body size ahead of the application, in the reverse proxy or servlet container, for endpoints that accept request bodies. Applications that require larger request bodies can adjust the struts.rest.content.maxLength configuration parameter after upgrading.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-05"
  }
]

## Technical details

The REST plugin reads request bodies into memory without enforcing any upper bound on accepted size, leading to unbounded heap allocation when processing a single request. This affects applications using the REST plugin in its default configuration; no additional settings need to be enabled to expose the vulnerability. The fixed versions implement a default 2 MB limit on request body size, which can be customized via the struts.rest.content.maxLength configuration parameter.

## Affected products

- Apache Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, 7.0.0 through 7.3.0

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://cwiki.apache.org/confluence/display/WW/S2-077](https://cwiki.apache.org/confluence/display/WW/S2-077)

## Related threats

- [Apache Struts race condition in message formatter for date/time arguments](https://junglewise.ai/threats/cve-2026-104714-concurrent-execution-using-shared-resource-with-improper)
- [Apache Struts asymmetric resource consumption in BigDecimal rendering](https://junglewise.ai/threats/cve-2026-104712-asymmetric-resource-consumption-amplification-vulnerability-in)
- [Apache Struts expression language injection in legacy RESTful action mapper](https://junglewise.ai/threats/cve-2026-104711-improper-neutralization-of-special-elements-used-in-an)
- [Apache Struts has a Denial of Service vulnerability](https://junglewise.ai/threats/cve-2025-66675-apache-struts-has-a-denial-of-service-vulnerability)
- [Apache Struts is Vulnerable to DoS via File Leak](https://junglewise.ai/threats/cve-2025-64775-apache-struts-is-vulnerable-to-dos-via-file-leak)