Read the docs
TI-2026-67840 Aliases CVE-2026-104714GHSA-5fhf-r6vm-6wj7

Race condition in Apache Struts leaks date and time values

Priority MEDIUM 41CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Apache Struts from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0 and from 7.0.0 through 7.3.0 is affected. A race condition (CWE-362) lets concurrent requests share a date or time message formatter without isolation. A remote attacker with low privileges can see another user's date or time value, or cause a server error. Applications whose localized messages format no date or time arguments are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts2.0.0 – 2.3.37; 2.5.0 – 2.5.33; 6.0.0 – 6.11.0; 7.0.0 – 7.3.0—No fix listedCNA
  • Apache Struts VendorApache Affected 2.0.0 – 2.3.37; 2.5.0 – 2.5.33; 6.0.0 – 6.11.0; 7.0.0 – 7.3.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*2.0.0 – 2.3.37; 2.5.0 – 2.5.33; 6.0.0 to before 6.12.0; 7.0.0 to before 7.4.0VulnerableApache
  • cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.0.0 – 2.3.37; 2.5.0 – 2.5.33; 6.0.0 to before 6.12.0; 7.0.0 to before 7.4.0 Vulnerable ·Apache

Remediation

Upgrade to Apache Struts 6.12.0 or 7.4.0, which fix the issue. The sources list no fixed version for Apache Struts 2.0.0 through 2.3.37 or 2.5.0 through 2.5.33. Red Hat rates the issue Moderate and lists Red Hat Enterprise Linux 8, 9 and 10 with no fix available, and Red Hat Fuse 7 with no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-104714
  2. 2026-10-06 Alias added: GHSA-5fhf-r6vm-6wj7
  3. 2026-10-06 CVSS score added · CISA ADP
  4. 2026-10-06 CISA SSVC decision points changed
  5. 2026-10-07 Priority changed: LOW → MEDIUM
  6. 2026-10-09 EPSS moved to the 50th–90th percentile
  7. 2026-10-09 CVSS score added · NVD
  8. 2026-10-25 EPSS moved to the below the 50th percentile
  9. 2026-11-06 Affected versions changed · Red Hat
  10. 2026-11-06 CVSS score added · Red Hat

References

Advisory 2

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences