The vulnerability resides in the JSON plugin of Apache Struts when the plugin is enabled. Because the plugin shares per‑request parsing state across concurrent requests, data stored during one request can leak into another request, allowing an attacker to read confidential information belonging to a different session and potentially bypass configured parsing limits. The flaw is identified as CWE‑567, an inconsistent implementation weakness.

Apache Struts 7.2.1 is affected. Only applications that explicitly enable the JSON plugin are vulnerable; applications that do not use the plugin are unaffected. The issue is fixed in Apache Struts 7.3.0.

The flaw can be exploited when the JSON plugin is enabled and the attacker can send JSON payloads to the application. A shared parsing state may cause data from one session to be exposed to another, allowing an attacker to read confidential information that belongs to a different session and to bypass configured parsing limits. The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation, while the vulnerability is not listed in the CISA KEV catalog. Because the plugin is not enabled by default, the overall risk remains modest, but the potential impact on confidentiality warrants remediation.