HighVulnerabilityupdated 2 Nov 2026, 06:15 UTC

Apache Struts2 JSON Plugin: element-count limit bypass enables insecure deserialisation

New1 source, unconfirmed

Severity	HighVulnerability
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	1 source, unconfirmedOnly one publisher so far, details may change

Timeline

2 Nov 2026, 06:10 UTC
Publicly disclosed
2 Nov 2026, 06:10 UTC
Reported by Full Disclosure · Full Disclosure
2 Nov 2026, 06:15 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Apache Struts2 JSON Plugin Insecure Deserialisation -- Object Deserialisation Element-Count Limit BypassFull Disclosure · 2 Nov 2026, 06:10 UTC

Technical details

ID: ZR-0284c35f
Disclosed: 2 Nov 2026, 06:10 UTC
On Zero Radar: 2 Nov 2026, 06:15 UTC (5 min after disclosure)
Last change: 2 Nov 2026, 06:15 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Apache Struts2 JSON Plugin: element-count limit bypass enables insecure deserialisation · Zero Radar