Security updatesApache Struts

Struts update fixes REST request and message format issues: inventory older website frameworks too

Apache Struts disclosed security issues on 5 October and recommends upgrading to 7.4.0 or 6.12.0 to address unbounded request reads in the REST plugin and concurrent message formatting that may expose date-time values.

Anti-Ransomware · Compiled with SI agent assistanceOfficial advisory publication date:Checked 2026.10.26
Original scenario illustration of maintenance staff checking legacy website forms, the Struts REST plugin and dependency information
Illustration · Source ↗ · About this image ↗

Source Facts

Apache Struts advisories dated 5 October recommend updating to 7.4.0 or 6.12.0. The two advisories respectively concern request-content handling in the REST plugin and the formatting of date or time values in localised messages during concurrent requests.

The official entries identify the issues as CVE-2026-104713 and CVE-2026-104714 and link to security advisories S2-077 and S2-078. Applications using the REST plugin or relevant message-format functions should check their actual deployments, rather than assuming every Struts website has the same exposure conditions.

Next Steps for Businesses / Editorial Observations

Frameworks may remain embedded in internal systems unchanged for years or in supplier-delivered packages. Asset inventories should include versions and enabled plugins.

Next steps you can take

  • Ask the application owner which Struts branch is used and whether REST plugins and date/time formatting features are in use.
  • Test the relevant fixed version and application behaviour, update deployment packages and related dependencies, and retain a version suitable for rollback.

Original sources

Apache Struts Announcements 2026 — 5 October 2026

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of modular container equipment and a tray with a defined boundaryIllustrationSecurity updates · 2026.10.26

Amazon Linux updates its Docker security advisory: check container hosts and archive handling

Amazon LinuxIllustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original scenario illustration of office colleagues checking computer updates and a maintenance checklistIllustrationSecurity updates · 2026.10.25

Emergency .NET update supplies a previously omitted fix: check Windows application versions again

Microsoft .NET