CVE-2026-73634

This CVE exposes a design flaw in Struts' CSP violation reporting that goes beyond the CVE's framing as an opt-in configuration issue. Versions 6.0.0 through 6.10.0 and 7.0.0 through 7.2.1 accept CSP reports from browsers into heap memory with no resource bounds — a pattern that exists precisely in the feature intended to improve security posture. Developers who implemented CSP reporting to harden their applications were precisely the ones exposed to heap exhaustion. The pre-authentication nature of this endpoint compounds the risk. CSP violation reporters are designed to receive cross-origin POST requests directly from browsers, meaning authentication doesn't apply. Critically, the attack surface extends beyond endpoint enumeration: any attacker who can trigger a CSP violation on the target domain — via reflected XSS, a compromised third-party script, or even legitimate cross-origin behavior — can force victim browsers to flood the report-uri. This creates a DoS vector where the attacker provides no infrastructure themselves; they weaponize the user's browser. The EPSS score of 0.00228 likely reflects current scanner capabilities rather than true exploitability, since CSP report endpoints are partially self-advertising through the CSP headers servers already emit. The simultaneous release of 6.11.0 and 7.3.0 strongly suggests a shared architectural component was patched, not scattered application misuse. This indicates Struts should audit other CSP-related utilities and security interceptors for similar unbounded-input patterns. The vulnerability demonstrates a framework-level failure: shipping security capabilities without hardened defaults, then framing the resulting risk as developer misconfiguration. Review your Struts deployment for any CSP report-uri endpoints and apply the 6.11.0 or 7.3.0 patches immediately — the risk model here is simpler than typical authenticated endpoints because the attacker doesn't need credentials or even to discover the endpoint if CSP headers are observable.

Reviewed through automated stages and approved by a human before publication.