A race condition exists in Apache Struts when a localized message formats a date or time argument. The shared message formatter retains the formatter instance application‑wide and serves concurrent requests without isolation, allowing a value belonging to one user to appear in another user response or causing a server error. This leads to unintended data disclosure and possible denial of service. The weakness is a classic race condition identified as CWE‑362.

The affected products are Apache Struts from the Apache Software Foundation. The vulnerability applies to Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0. Applications that do not use localized messages containing date or time arguments are not impacted.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of < 1% suggests a low probability of exploitation, and it is not listed in the CISA KEV catalog. The attack requires concurrent user requests that exercise localized date/time formatting. In the absence of widespread exploitation data, the risk remains contingent on the use of the vulnerable feature.