Loading vulnerability…
CVE-2026-73633 is an uncontrolled resource consumption vulnerability in the optional JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads the entire request body into memory without enforcing an effective upper bound. Although the plugin exposes a configurable JSON input length limit, that limit does not constrain this memory read, allowing an oversized request to consume excessive heap space. Affected versions are Apache Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.10.0, and 7.0.0 through 7.2.1.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a working Python denial-of-service PoC for CVE-2026-73633 targeting Apache Struts JSON body handling, plus a Dockerized vulnerable lab environment to reproduce the issue. The main exploit is poc.py, which parses a target URL, opens raw HTTP/HTTPS socket connections, and repeatedly streams very large JSON POST bodies without buffering the full payload client-side. The payload format is a single JSON object with one oversized string field, and the script supports configurable body size in MiB, concurrency via threads, periodic health probing, and optional local Docker resource monitoring. The attack is intended to trigger excessive CPU and memory consumption in Struts endpoints using the JSON plugin/interceptor, resulting in service degradation rather than code execution. Repository structure: README.md explains the vulnerability concept and usage; poc.py is the exploit entry point; docker/ contains a self-contained demo environment. The Docker lab builds a Struts 7.1.1 WAR with struts2-json-plugin, deploys it on Tomcat 10.1, and exposes port 8080. The Java app includes LoginAction.java, struts.xml, web.xml, and login.jsp. The vulnerable path is /login.action, configured with the json interceptor and exercised by the JSP via fetch() using application/json. Overall, this is a genuine operational DoS PoC with a reproducible target environment, not a detection-only script and not a fake exploit.
Repository contains a working Python DoS proof-of-concept plus a Dockerized vulnerable/demo environment. The main exploit is poc.py, a standalone Python 3 script that parses a target URL, opens raw TCP/TLS connections, and streams oversized JSON POST bodies without buffering the full payload client-side. It repeatedly sends bodies shaped like {"a":"..."} with configurable size (--size, default 2048 MiB per request), concurrency (--threads), and periodic status checks (--interval). Worker threads run in an infinite loop until interrupted, making this an operational resource-exhaustion tool rather than a mere detector. The script also performs lightweight POST probes to measure responsiveness and can call local 'docker stats' to show container memory usage when --local is enabled. The repository also includes a reproducible lab under docker/: a Maven-built Struts 7.1.1 webapp deployed to Tomcat 10.1. The Java action (LoginAction.java) implements a trivial username/password check, while struts.xml enables the JSON interceptor and maps the login action to a JSON result. login.jsp submits JSON via fetch() to login.action, demonstrating the JSON body population path the PoC is intended to stress. docker-compose.yml publishes the app on port 8080, and the README documents test credentials and example requests. Overall purpose: demonstrate and reproduce CVE-2026-73633 / Apache Struts S2-072 as a denial-of-service condition tied to JSON body handling. Main exploit capability is repeated large-body HTTP POST flooding against a Struts JSON endpoint, leading to CPU and memory pressure on the target service.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.