## https://sploitus.com/exploit?id=ABF46B8C-CDA0-50DF-8402-76B81B3EC03F
# CVE-2026-73633 (Apache Struts S2-072) — PoC + Environment
## Principle:
The “JSON filling” feature, which is enabled on the server with a JSON body plugin, is a core functionality provided by the Struts 2 JSON plugin. It can be simply understood as an automatic data conversion mechanism.
The parser of the JSON filling function reads all the json content of the request body into memory at once, while processing JSON arrays.
This causes consumption (and CPU usage).
## Testing:
I deployed a Struts application using WSL2 and Tomcat. I created a login page with a username “admin” and a password “123456”.
During the actual testing, the most significant increase was in CPU usage; memory usage also increased. After the request ended (tcp connection closed), only CPU usage decreased, while memory did not decrease automatically.
(Under default configuration, the test lasted for 3 minutes. CPU usage increased from 7 to 32, and memory increased from 9.8GB to 11GB.) This did not cause a crash.
It only caused strain on the container’s resources. Once the memory usage reached a fixed value, it no longer increased. This fixed value is proportional to the filling size parameter.)