Posted by Daniel Owens via Fulldisclosure on Nov 01
Description
Apache Struts2 Core version 7.4.0 and below fails to properly prevent integer overflows, causing wrap-arounds and other
issues on a downstream forced casting into types smaller than `BigInteger`. Importantly, this finding underscores why
all applications using Struts and other such platforms should perform their own input validation checks and not blindly
assume that the upstream Struts2 code has done as such, but the finding also…
Source: Full Disclosure (seclists.org) · 2026-11-02