## https://sploitus.com/exploit?id=4A9059D4-C01D-5ECD-867C-D3E891BC657C
# CVE-2026-73633 (Apache Struts S2-072) — PoC + Environment
## Principle:
The “JSON filling” feature, which is enabled on the server with a JSON body plugin, is a core functionality provided by the Struts 2 JSON plugin. It can be simply understood as an automatic data conversion mechanism.
The parser of the JSON filling function reads all the json content of the request body into memory at once, while processing the JSON array.
This causes consumption (and CPU usage).
## Testing:
I deployed a Struts application using WSL2 and Tomcat. I created a login page with a username “admin” and a password “123456”.
During the actual testing, the most noticeable increase was in CPU usage, followed by memory usage. After the request processing is completed, the CPU usage will decrease.
Once memory runs out (OOM), the garbage collection mechanism will trigger, but the memory will never be completely exhausted; it never causes a crash.
It only causes strain on the server resources. Once the memory reaches a fixed value (OOM trigger point), it will no longer increase. The memory will be reclaimed by the garbage collector and reused again and again…
CPU usage increases proportionally to the filling value (“--size”).