A request body is read into memory without any bounds, allowing a single request to allocate an arbitrarily large amount of Java heap. This can lead to exhaustion of memory resources and deny service to legitimate users. The weakness is a form of resource exhaustion and is identified as CWE-770.

The Apache Struts framework, versions 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0, are affected. Applications that do not use the REST plugin are not impacted.

The vulnerability is exploitable over the network by sending a large REST request. No additional configuration is required. The CVSS score of 6.5 indicates moderate severity. As the EPSS score is under 1% and it is not listed in KEV, the likelihood of publicly known exploitation remains low, but a successful attack would cause a denial of service to all users of the affected application.