CVE-2026-104714
Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
| CWE | CWE-362 |
| Vendor | apache software foundation |
| Product | apache struts |
| Published | Oct 5, 2026 |
| Last Updated | Oct 5, 2026 |
Get instant alerts for apache software foundation apache struts
Be the first to know when new unknown vulnerabilities affecting apache software foundation apache struts are published — delivered to Slack, Telegram or Discord.