An attacker can send a normal HTTP request containing a request parameter that is bound to a java.math.BigDecimal property. When the framework renders that property through its tag library, the response size can become many orders of magnitude larger than the incoming request, causing excessive CPU load and outbound bandwidth use. The vulnerability enables an unauthenticated remote attacker to exhaust server resources with sustained low‑volume traffic, potentially causing service disruption.

Apache Struts is affected in all 2.5.x releases from 2.5.14 through 2.5.33, in the 6.x stream from 6.0.0 through 6.11.0, and in the 7.x stream from 7.0.0 through 7.3.0. The vendor recommends upgrading to 6.12.0 or to 7.4.0 for the respective streams.

The flaw can be exploited remotely without authentication and has a high amplification factor that can lead to denial of service. The CVSS score of 7.5 indicates a high severity. No EPSS score is available and the vulnerability is not listed in CISA KEV, but the lack of public exploitation does not reduce the risk; an attacker can craft simple requests that trigger the over‑large response. The impact is potentially system‑wide, affecting all requests that render BigDecimal properties, and the attack vector is straightforward HTTP traffic.