CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected. This issue affects Apache Struts: 7.2.1. Users are recommended to upgrade to version 7.3.0, which fixes the issue.

• CWE-567

• https://cwiki.apache.org/confluence/display/WW/S2-071Vendor Advisory, Mitigation

Published

Aug 15, 2026

Last Modified

Aug 18, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73627JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5…6
• CVE-2026-73628Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflect…6.1
• CVE-2026-73629Serendipity before 2.6.0 contains a server-side request forg…8.5
• CVE-2026-7363Use after free in Canvas in Google Chrome on Linux, ChromeOS…8.8
• CVE-2026-73630SiYuan before v3.7.4 contains an information disclosure vuln…5.8
• CVE-2026-73631Exposure of data element to wrong session vulnerability in t…4.3
• CVE-2026-73633Uncontrolled resource consumption vulnerability in the JSON …7.5
• CVE-2026-73634Uncontrolled resource consumption vulnerability in Apache St…7.5
• CVE-2026-73635Allocation of resources without limits or throttling vulnera…7.5
• CVE-2026-7364IBM Verify Identity Access 11.0 through 11.0.2 and IBM Secur…6.1
• CVE-2026-73643js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 u…7.5
• CVE-2026-73644OpenDJ is an LDAPv3 compliant directory service. Prior to 5.…9.6