Posted by Daniel Owens via Fulldisclosure on Nov 01
As of the current versions of the Apache Struts2 JSON Plugin (e.g., version 7.4.0 and the 7.5.0 snapshot dated 28
October 2026), attackers can bypass the element-count limit purported to protect Object deserialisation added to said
code as part of the WW-5618 and S2-072 “hardening controls”. Please note that this vulnerability and the attack string
is different than the previously reported bypass against the JSON array…
Source: Full Disclosure (seclists.org) · 2026-11-02