The Irony of Banking: Finding Flaws in a Legacy Java Framework with a Bank‑Built AI Harness
Two new Apache Struts CVEs show how a bank‑built AI harness for Claude Opus 4.8 can find real, unauthenticated DoS flaws in the legacy Java frameworks powering global banking.
There is a loud, incredibly valid conversation happening right now in the AppSec and bug‑hunting communities about “AI slop.”
We have all seen it: a wave of inexperienced users spinning up basic automated LLM scripts, scraping repositories, and spamming open‑source maintainers with thousands of low‑quality, context‑blind “vulnerability reports” that turn out to be massive false positives. This noise actively drains the limited time and energy of the open‑source developers who keep the internet running. It has rightfully given AI‑assisted bug hunting a bad reputation.
But when you strip away the automated spam and actually pair these advanced models with a deliberate, high‑level human strategy, the results are not just real they are deeply impactful.
As a hobbyist who only does bug hunting in my spare time as a side project, I recently wanted to test the limits of what a highly focused, AI‑assisted security stack could do against core web infrastructure.
The results of that experiment just went public today with the release of two official security bulletins for Apache Struts:
Lukasz Lenart
Lukasz Lenart
Both vulnerabilities represent unauthenticated, remote “unbounded read” resource‑consumption flaws (CWE‑400). One was embedded directly inside a core JSON request‑body parser, and the other was located within the Content Security Policy (CSP) violation report endpoint. Left unpatched, an attacker could exploit these endpoints from anywhere in the world without credentials, forcing the Java Virtual Machine (JVM) into severe heap exhaustion, locking up the garbage collector, and completely knocking the web server offline.
The patches are now officially merged and shipped in the latest release. But the technical details of the bugs pale in comparison to the massive operational irony behind how they were discovered.
CVE-2026-73633
Click to view the public intelligence timeline and heap exhaustion bug details.
CVE-2026-73634
Click to view the public intelligence timeline and Content Security Policy report vulnerability details.
The Great FinTech Irony: Struts in 2026
The ultimate irony of this discovery lies at the intersection of enterprise banking history and modern open‑source tool development.
Apache Struts is a legacy web framework. In the world of modern greenfield development, engineering teams almost exclusively favor cloud‑native stacks, Jakarta EE, or Spring Boot. Yet, entering 2026, Apache Struts still maintains a quiet, incredibly massive footprint inside the world’s largest financial institutions.
It remains deeply embedded in mission‑critical, back‑office workflows, administrative portals, and core online banking systems built during the 2000s and 2010s. For these global institutions, Struts was historically the perfect architectural fit: its strict Model‑View‑Controller (MVC) design and heavy configuration‑driven validation were ideal for complex, form‑heavy, compliance‑driven applications.
Because these systems are so deeply entrenched in day‑to‑day capital movement, rewriting them from scratch is extraordinarily expensive, logistically risky, and frequently deferred by executive leadership as long as the system remains functional. Telemetry from early 2026 on Maven Central confirms this legacy reality, showing staggeringly high weekly download counts for Struts artifacts with roughly 98% of those downloads targeting end‑of‑life (EOL) 2.x branches.
This brings us to the core irony of this research project: these framework‑level flaws, living inside a legacy ecosystem heavily relied upon by global finance, were uncovered using an open‑source, AI‑assisted security tool explicitly built and released by a major bank.
The tool that powered this audit was VulnHunter, the advanced AI‑assisted security scanner developed and open‑sourced by Capital One. To execute the deep code analysis, map the control flows, and validate the exploitation paths, I paired VulnHunter’s automated scanning architecture with Claude Code and the Claude Opus 4.8.
The Real‑World Footprint of the Target
To understand why securing core infrastructure data parsers in Apache Struts matters so much, one only has to look at the scale of the institutions that still maintain this framework within their application ecosystems.
Public technology stacks, developer LinkedIn profiles, and historical security analyses track active or legacy Struts code footprints across some of the largest financial institutions on Earth, including major global banks in the United States, Canada, the United Kingdom, and continental Europe.
When an unauthenticated, remote denial‑of‑service bug is discovered in a core data parser for a framework with this specific deployment profile, the risk isn’t theoretical. A severe heap‑exhaustion flaw means a single attacker can systematically target exposed endpoints and disrupt enterprise operations without ever needing to crack an authentication barrier.
Driving the Machine: Strategy Over Automation
The successful discovery and patching of CVE‑2026‑73633 and CVE‑2026‑73634 prove that the narrative surrounding AI in cyber security needs to shift. The problem isn’t the AI tools themselves; it is the absence of human direction.
An LLM or an automated agent tool like VulnHunter or Opus cannot operate in a vacuum. If you simply point a model at a massive code base and say “find bugs,” it will drown you in low‑severity noise and false positives. That's changing now that organisations in the Project Glasswing program get unrestricted access to advanced models like fable 5.
But for the rest of us, the machine needs a human in the loop to drive the high‑level strategy. It requires a human engineer to define the context, isolate the critical data entry points, and understand why a specific parsing loop is dangerous. In this case, the strategy relied entirely on guiding the AI stack away from generic logic flaws and forcing it to deeply evaluate how the framework handled memory boundaries during unauthenticated streaming inputs.
By defining those guardrails manually, VulnHunter and Claude were able to cut entirely through the slop, zeroing in precisely on the unbounded reads in the JSON parser and the CSP reporting endpoints. The AI acted as the ultimate code‑navigation engine, but human oversight was required to validate the impact and ensure the fix wouldn’t break the strict backwards‑compatibility needs of a Tier 1 project.
A Blueprint for Coordinated Disclosure
As a hobbyist, stepping into the security arena of an Apache Software Foundation Tier 1 project can be intimidating. But the entire process serves as a masterclass in how open‑source security should work.
The Apache Struts Security Team handled this disclosure with absolute professionalism, transparency, and speed. They particularly appreciated that the vulnerabilities were not reported in public until they had the chance to confirm them, and ensure that the patches were shipped.
Their internal engineering philosophy states a clear mission:
To avoid any attacks which can cause the server to consume resources in a non‑linear relationship to the size of inputs.
Because these unbounded reads perfectly violated that philosophy, they prioritised the fixes immediately, worked smoothly through the patch validations, and ensured a synchronised, safe public release.
For hobbyists and enterprise engineers alike, the takeaway is clear: don’t let the “AI slop” discourse discourage you from using these tools. If you back your tools with an actual security strategy, you can find real flaws, protect legacy infrastructure, and help secure the open‑source code that the financial world relies on every single day.
