This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch docs/s2-070-to-s2-074-announcements in repository https://gitbox.apache.org/repos/asf/struts-site.git
commit 3a6bfb96859d15d3be2d4dd0f645d48e2acf773b Author: Lukasz Lenart <[email protected]> AuthorDate: Fri Aug 14 09:07:09 2026 +0200 docs: announce security bulletins S2-070 to S2-074 Five bulletins were published on the cwiki on 14 August 2026, covering CVE-2026-73631 through CVE-2026-73635. All five are fixed in 7.3.0, and the three that also affect the 6.x line are fixed in 6.11.0. Each CVE gets its own dated entry so it can be linked individually, in the S2-068/S2-069 form. Anchors are disambiguated (a20260814-s2071 and onwards) because all five share a date. On the home page the security box now points at the whole batch rather than a single bulletin, and S2-069 moves into the slot vacated by S2-068, which is a year old. Co-authored-by: Claude Opus 5 <[email protected]> --- source/announce-2026.md | 64 +++++++++++++++++++++++++++++++++++++++++++++++++ source/index.html | 20 +++++++++------- 2 files changed, 76 insertions(+), 8 deletions(-) diff --git a/source/announce-2026.md b/source/announce-2026.md index f86ec0b4b..578ba7e05 100644 --- a/source/announce-2026.md +++ b/source/announce-2026.md @@ -13,6 +13,70 @@ title: Announcements 2026 Skip to: <a href="announce-2025">Announcements - 2025</a> </p> +#### 14 August 2026 - CVE-2026-73631: Shared parsing state in the JSON plugin {#a20260814} + +The Apache Struts group recommends upgrading to Apache Struts version 7.3.0 to mitigate potential security +vulnerability when populating actions from a JSON request body with the +[JSON plugin](https://struts.apache.org/plugins/json/). Only Struts 7.2.1 is affected. + +> Please read the Security Bulletin [S2-070](https://cwiki.apache.org/confluence/display/WW/S2-070) to find more +> details about this security vulnerability + +**All developers are strongly advised to perform this upgrade.** + +You can download the latest version from our [download](download.cgi#struts-ga) page. + +#### 14 August 2026 - CVE-2026-73632: Shared serialization state in the JSON plugin {#a20260814-s2071} + +The Apache Struts group recommends upgrading to Apache Struts version 7.3.0 to mitigate potential security +vulnerability when using the SMD / JSON-RPC support of the +[JSON plugin](https://struts.apache.org/plugins/json/). Only Struts 7.2.1 is affected. + +> Please read the Security Bulletin [S2-071](https://cwiki.apache.org/confluence/display/WW/S2-071) to find more +> details about this security vulnerability + +**All developers are strongly advised to perform this upgrade.** + +You can download the latest version from our [download](download.cgi#struts-ga) page. + +#### 14 August 2026 - CVE-2026-73633: Unbounded read of a JSON request body {#a20260814-s2072} + +The Apache Struts group recommends upgrading to Apache Struts version 7.3.0 or 6.11.0 to mitigate potential security +vulnerability when populating actions from a JSON request body with the +[JSON plugin](https://struts.apache.org/plugins/json/). + +> Please read the Security Bulletin [S2-072](https://cwiki.apache.org/confluence/display/WW/S2-072) to find more +> details about this security vulnerability + +**All developers are strongly advised to perform this upgrade.** + +You can download the latest version from our [download](download.cgi#struts-ga) page. + +#### 14 August 2026 - CVE-2026-73634: Unbounded read of a Content Security Policy violation report {#a20260814-s2073} + +The Apache Struts group recommends upgrading to Apache Struts version 7.3.0 or 6.11.0 to mitigate potential security +vulnerability in applications that expose an endpoint collecting Content Security Policy violation reports. + +> Please read the Security Bulletin [S2-073](https://cwiki.apache.org/confluence/display/WW/S2-073) to find more +> details about this security vulnerability + +**All developers are strongly advised to perform this upgrade.** + +You can download the latest version from our [download](download.cgi#struts-ga) page. + +#### 14 August 2026 - CVE-2026-73635: Unbounded growth of localized-text caches driven by the request locale {#a20260814-s2074} + +The Apache Struts group recommends upgrading to Apache Struts version 7.3.0 or 6.11.0 to mitigate potential security +vulnerability affecting [localized-text](https://struts.apache.org/core-developers/localization) lookups when no fixed +locale is configured. + +> Please read the Security Bulletin [S2-074](https://cwiki.apache.org/confluence/display/WW/S2-074) to find more +> details about this security vulnerability + +**All developers are strongly advised to perform this upgrade.** + +You can download the latest version from our [download](download.cgi#struts-ga) page. + #### 1 August 2026 - Apache Struts version 7.3.0 General Availability {#a20260801} The Apache Struts group is pleased to announce that Apache Struts version 7.3.0 is available as a "General Availability" diff --git a/source/index.html b/source/index.html index 2993958e7..e9f9c0131 100644 --- a/source/index.html +++ b/source/index.html @@ -50,13 +50,17 @@ title: Welcome to the Apache Struts project </div> <div class="row"> <div class="column col-md-4"> - <h2>CVE-2025-68493: XXE vulnerability in XWork component</h2> + <h2>Security Bulletins S2-070 to S2-074</h2> <p> - Upgrade to at least Apache Struts 6.1.1 to mitigate the vulnerability. + Upgrade to Apache Struts 7.3.0 or 6.11.0 to mitigate the vulnerabilities. </p> <p> - Read more in the <a href="announce-2026#a20260111">Announcement</a> or in - the Security Bulletin <a href="{{ site.wiki_url }}/S2-069">S2-069</a> + Read more in the <a href="announce-2026#a20260814">Announcements</a> or in + the Security Bulletins <a href="{{ site.wiki_url }}/S2-070">S2-070</a>, + <a href="{{ site.wiki_url }}/S2-071">S2-071</a>, + <a href="{{ site.wiki_url }}/S2-072">S2-072</a>, + <a href="{{ site.wiki_url }}/S2-073">S2-073</a> and + <a href="{{ site.wiki_url }}/S2-074">S2-074</a> </p> </div> <div class="column col-md-4"> @@ -68,13 +72,13 @@ title: Welcome to the Apache Struts project </p> </div> <div class="column col-md-4"> - <h2>CVE-2025-64775 File leak in multipart request processing causes disk exhaustion (DoS)</h2> + <h2>CVE-2025-68493: XXE vulnerability in XWork component</h2> <p> - Upgrade to Apache Struts 6.8.0 or 7.1.1 to mitigate the vulnerability. + Upgrade to at least Apache Struts 6.1.1 to mitigate the vulnerability. </p> <p> - Read more in the <a href="announce-2025#a20251201">Announcement</a> or in - the Security Bulletin <a href="{{ site.wiki_url }}/S2-068">S2-068</a> + Read more in the <a href="announce-2026#a20260111">Announcement</a> or in + the Security Bulletin <a href="{{ site.wiki_url }}/S2-069">S2-069</a> </p> </div> </div>
