APACHE patched five vulnerabilities in Struts 2, including three Denial-of-Service (DoS) flaws that can be exploited by unauthenticated remote users. The JSON plugin had two data leakage issues due to shared state bugs. Key points include: 1) **DoS Risks**: Attackers can exploit oversized requests to exhaust server memory without authentication.
2) **JSON Plugin Vulnerabilities**: Bugs (CVE-2026-73631 and CVE-2026-73632) involve data leaks across requests, while CVE-2026-73633 and CVE-2026-73634 allow for unbounded memory reads linked to JSON request handling and CSP report collection, respectively. 3) **Locale Cache Issue**: CVE-2026-73635 enables remote DoS by growing an internal cache due to varying locale values from requests. 4) **Mitigation**: Apache recommends upgrading to Struts 7.3.0 or 6.11.0. Users can mitigate risks by adjusting JSON interceptor settings or enforcing maximum request sizes.