This vulnerability allows an attacker to send a Content Security Policy violation report to an exposed endpoint that reads the entire payload into memory without any bounds. The consuming operation can exhaust the Java heap, causing the application to crash or become unresponsive, thus denying service to legitimate users. The flaw is a classic uncontrolled resource consumption issue (CWE‑400).

All Apache Struts applications that expose a CSP violation report collection endpoint are affected. The core distribution includes the vulnerable logic in versions 6.0.0 through 6.10.0 and in 7.0.0 through 7.2.1. Applications that do not expose such endpoints are not impacted.

The endpoint is publicly accessible without authentication, making the attack vector straightforward. The CVSS score is 7.5, and the EPSS score is < 1%; the absence of a KEV listing does not reduce the threat; an attacker can craft a single oversized request to deplete heap memory. The result is an availability outage that can disrupt entire services built on Struts.