cuteecat/cve-2026-73633Proof-of-concept exploit for Apache Struts S2-072 (CVE-2026-73633), demonstrating CPU and memory exhaustion by sending crafted JSON requests to the Struts JSON plugin.
It comes from the JSON population of the server-side enabled JSON body plugin ("JSON population" is a core feature provided by the JSON plugin in Struts 2, which can be simply understood as an automatic data conversion mechanism.)
When the parser of the JSON population feature processes JSON arrays, it reads all the JSON content of the request body into memory at once (loading item by item)
Causing memory consumption (and CPU consumption)
I used WSL2 and Tomcat to deploy a Struts application and built a login page, with username admin and password 123456
In actual testing, the most obvious increase on the machine was CPU usage, followed by memory; and after the request was processed, the CPU usage was released
Once OOM occurs, GC collection is triggered, so the memory will never be completely filled up, far from causing a crash
It only causes server resource strain on the container. After rising to a fixed memory usage value (the OOM trigger point), it stops increasing, and will be repeatedly reclaimed by GC, re-occupied, reclaimed again... ...
CPU growth is directly proportional to the fill value (--size)
git clone https://github.com/CuteeCat/CVE-2026-73633.git
cd CVE-2026-73633
cd docker
docker-compose build
docker-compose up -d
cd ..
python poc.py --url http://127.0.0.1:8080/login.action --local