CVE-2026-104714 is a High severity race condition in Apache Struts, published as security bulletin S2-078. When a localized message formats a date or time, a shared formatter can show one user's value in another user's response or fail with an error. Apache recommends upgrading to Struts 6.12.0 or 7.4.0.
What's affected
- Product: Apache Struts, the Java web framework.
- Affected: 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0 and 7.0.0 through 7.3.0.
- Fixed: 6.12.0 or 7.4.0, per the Apache announcement.
- Not affected: applications whose localized messages format no date or time arguments.
- Score: CVSS 8.8, High, per the record. No fixed 2.x release is named, so those lines need a move to a supported branch.
Source note: the Apache bulletin page S2-078 did not render in my fetch, so I used the announcement posted to the oss-security list, which repeats the same text as the record. The record's CVSS vector rates the impact as high for confidentiality, integrity and availability, while the description is about data crossing between sessions and server errors. Read the bulletin itself to judge impact for your own application.
How to check if you're exposed
Start with the Struts version that each application bundles.
mvn dependency:tree | grep -i struts
./gradlew dependencies | grep -i struts
unzip -l app.war | grep -i struts2-core
The last command lists the core jar inside a deployed WAR file, and its file name carries the version. Compare it with the affected ranges.
Then check whether the issue can bite. It needs a localized message with a date or time argument, rendered through the application wide text provider. Search your resource bundles for message patterns that contain date or time placeholders. If there are none, Apache says the application is not affected, although upgrading is still the right long term answer.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
What to do now
- Inventory every Struts application, including old internal tools, with its exact version.
- Upgrade to Struts 6.12.0 on the 6.x line or 7.4.0 on the 7.x line, and run your regression tests.
- If you are on the 2.x lines, plan a move to a supported branch. The announcement names only 6.12.0 and 7.4.0 as fixes.
- Search resource bundles for date and time message arguments to learn whether you are affected today.
- As a stopgap, review pages that show formatted dates for odd values, and watch for errors in the logs that mention formatting.
- Add Struts applications to continuous monitoring so a new bulletin does not depend on someone remembering.
Why it matters
The record lists CWE-362, concurrent execution using a shared resource with improper synchronization. A date formatter object is kept for each message by the application wide text provider, and many requests use it at the same time. Such formatters are not safe to share across threads, so a value from one request can bleed into another.
That is why the description talks about a value belonging to one user appearing in another user's response. For a banking page or a patient portal, even a formatted date can be personal. When the shared state is corrupted, rendering can also fail with a server error.
The record does not list this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog. Struts has a long history, so teams often have old instances. Use a software inventory to find them, and reachability analysis to separate applications that actually render dates from those that do not.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use Struts but no localized dates?
The Apache text says applications whose localized messages format no date or time arguments are not affected.
Which versions fix it?
Apache names Struts 6.12.0 and 7.4.0 as the fixed versions.
Sources
Last reviewed: 18 October 2026.
