Posted by Daniel Owens via Fulldisclosure on Nov 01 Description The Apache Struts2 REST Plugin's (version 7.4.0 and below) `ContentTypeInterceptor.intercept(ActionInvocation)` only deserialises a request body and enforces the `struts.rest.content.maxLength` bound when `HttpServletRequest#getContentLength()` returns a positive value. `getContentLength()` returns `-1` whenever the `Content-Length` header is absent, which normal and appropriate for any Hypertext Transfer Protocol (HTTP)...