UnratedVulnerabilityupdated 2 Nov 2026, 06:15 UTC

Apache Struts2 REST plugin mishandles untrimmed Accept header tokens

New1 source, unconfirmed

Severity	UnratedVulnerability
Being exploited?	UnclearNo reports either way yet
Fix available?	UnclearNo fixed version published in the sources yet
How sure is this?	1 source, unconfirmedOnly one publisher so far, details may change

Timeline

2 Nov 2026, 06:10 UTC
Publicly disclosed
2 Nov 2026, 06:10 UTC
Reported by Full Disclosure · Full Disclosure
2 Nov 2026, 06:15 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Apache Struts2 REST Plugin Untrimmed `Accept` Header Tokens Break Content Negation FallbackFull Disclosure · 2 Nov 2026, 06:10 UTC

Technical details

ID: ZR-ec11bba1
Disclosed: 2 Nov 2026, 06:10 UTC
On Zero Radar: 2 Nov 2026, 06:15 UTC (5 min after disclosure)
Last change: 2 Nov 2026, 06:15 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Apache Struts2 REST plugin mishandles untrimmed Accept header tokens · Zero Radar