IT SBIT Services
Schneeberger
DEEN
CVE tracker

Apache Struts 2: Race condition exposes date and time values across requests

CVE-2026-104714High 8.8

← All vulnerabilities

Summary

Apache Struts 2 uses a shared message formatter for localized messages that format date or time arguments. Under concurrent requests, one user's date or time value can appear in another user's response, or rendering can fail with a server error. Only applications whose own message bundles format date or time arguments are affected; no message shipped with Struts does so. The CVE record scores it CVSS 3.1 8.8 (PR:L), while Apache rates it Moderate.

Affected

  • Apache Struts 2.0.0 through 2.3.37 (EOL)
  • Apache Struts 2.5.0 through 2.5.33 (EOL)
  • Apache Struts 6.0.0 through 6.11.0
  • Apache Struts 7.0.0 through 7.3.0
  • Only applications with localized messages that format date or time arguments are affected.

Fixed in

  • Struts 7.x: upgrade to 7.4.0
  • Struts 6.x: upgrade to 6.12.0
  • Struts 2.x (EOL): no fix from Apache; migration or a third-party extended support product is required

Workaround

  • Format the date or time value in code before passing it to the message, and use a message that inserts the already-formatted value without applying a date or time format. This removes the exposure for that message.
  • Applications whose localized messages format no date or time arguments require no action.

Exploitation

  • Not known to be exploited. CISA SSVC: exploitation none, automatable no, technical impact total.
  • No public proof of concept found. EPSS about 0.005.
  • Ordinary concurrent traffic can trigger the issue; no malicious request is needed.

Our recommendation

  • Inventory all Struts 2 usage, including the org.apache.struts:struts2-core dependency.
  • Upgrade to Struts 7.4.0 or 6.12.0. Verify the final 6.12.0 artifact on Maven Central before rollout.
  • Where your own message bundles format date or time arguments, apply the code workaround as an interim step.
  • Plan migration away from EOL 2.x branches.
  • Monitor application logs for server errors on localized pages.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:33.

Original description (NVD)

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed