The Apache Struts JSON plugin contains an unbounded read of the request body. When an application is configured to populate actions from a JSON request body, the plugin reads the entire body into memory without any limit. A single crafted request can overflow the heap and cause a denial of service, affecting all users of the application. The vulnerability is an uncontrolled resource consumption flaw, CWE‑400.

Apache Struts is affected in the following releases: 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.10.0, and 7.0.0 through 7.2.1. Applications that use the JSON plugin with request‑body handling enable or import this component are at risk; those that do not use the plugin or that disable request‑body handling are not affected.

Attackers can trigger the issue by sending a large JSON payload to an endpoint that processes JSON request bodies. The exploit path requires that the vulnerable application accept the request and attempt to populate actions from the body. The CVSS score of 7.5 indicates high severity. The EPSS score is not available, indicating limited publicly disclosed exploitation data. The vulnerability is not listed in CISA’s KEV catalog, but due to the potential for service disruption in web applications, it warrants prompt remediation.