An uncontrolled resource consumption vulnerability in the Apache Struts JSON plugin poses a risk of service interruption through denial-of-service attacks.

The vulnerability (CWE-400) exists within the JSON plugin, allowing unauthenticated attackers to trigger excessive resource consumption. This can lead to application instability or total service unavailability.

With a CVSS score of 7.5, this vulnerability represents a significant threat to business continuity. Successful exploitation allows for a denial-of-service condition, which can halt critical business operations and lead to substantial downtime for applications relying on the Apache Struts framework.

Immediate Action: Consult the official Apache Struts security bulletin S2-072 for guidance on mitigating this resource consumption issue, as a specific patch version was not explicitly provided in the source data.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory consumption, for sudden spikes that may indicate an ongoing denial-of-service attempt.

Compensating Controls: Implement rate limiting and request size restrictions at the network or application layer to mitigate the impact of excessive resource requests.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

The availability of a public proof-of-concept necessitates immediate attention to this vulnerability. Administrators should review the Apache Struts security advisory S2-072 and apply the recommended configurations or updates as soon as they become available to prevent potential service outages.