Posted by Daniel Owens via Fulldisclosure on Nov 01
Description
The Apache Struts2 REST Plugin’s (version 7.4.0 and below) `ContentTypeInterceptor.intercept(ActionInvocation)` only
deserialises a request body and enforces the `struts.rest.content.maxLength` bound when
`HttpServletRequest#getContentLength()` returns a positive value. `getContentLength()` returns `-1` whenever the
`Content-Length` header is absent, which normal and appropriate for any Hypertext Transfer Protocol (HTTP)…
Source: Full Disclosure (seclists.org) · 2026-11-02