Allocation of resources without limits leads to unbounded growth of localized-text caches when the locale comes from an incoming request. An unauthenticated remote client can repeatedly request content in different locales, making the cache expand until the Java heap is exhausted and causing the application to become unresponsive. This weakness is a classic example of CWE‑770 and can result in denial of service for all users of the affected application.

The vulnerability is in Apache Software Foundation’s Apache Struts. Versions from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.10.0, and from 7.0.0 through 7.2.1 are impacted. Applications that configure a fixed locale are not affected. The recommended fixes are upgrading to Apache Struts 6.11.0 or 7.3.0.

Because the exploit requires only crafting an HTTP request with a locale parameter and does not need authentication, the attack vector is remote and straightforward. The CVSS score of 7.5 indicates a high severity, and the EPSS score of < 1% suggests low probability of exploitation, but the absence of limits on cache growth gives the attacker the opportunity to exhaust the heap. The vulnerability is not listed in CISA’s KEV catalog. An attacker could quickly exhaust the heap, leading to system-wide denial of service affecting the web application and potentially other services sharing the same Java process.