Apache Struts (Apache Software Foundation) - vulnerabilities (CVEs)

33 CVEs, 4 in the last 30 days, 3 known versions, newest CVE from 2026-10-05. Vendor: Apache Software Foundation.

CVEs of Apache Struts

• CVE-2026-104714 - CVSS 8.8 (high), 2026-10-05: Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats…
• CVE-2026-104713 - CVSS 6.5 (medium), 2026-10-05: Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on…
• CVE-2026-104712 - CVSS 7.5 (high), 2026-10-05: Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal…
• CVE-2026-104711 - CVSS 9.8 (critical), 2026-10-05: Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the…
• CVE-2026-73632 - CVSS 4.3 (medium), 2026-08-15: Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across…
• CVE-2026-73631 - CVSS 4.3 (medium), 2026-08-15: Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent…
• CVE-2026-73635 - CVSS 7.5 (high), 2026-08-15: Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text…
• CVE-2026-73634 - CVSS 7.5 (high), 2026-08-15: Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports…
• CVE-2026-73633 - CVSS 7.5 (high), 2026-08-14: Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request…
• CVE-2025-68493 - CVSS 8.1 (high), 2026-01-11: Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1…
• CVE-2025-66675 - CVSS 8.2 (high), 2025-12-10: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from…
• CVE-2025-64775 - CVSS 7.5 (high), 2025-12-01: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from…
• CVE-2024-53677 - CVSS 9.8 (critical), 2024-12-11: File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can…
• CVE-2023-50164 - CVSS 9.8 (critical), 2023-12-07: An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be…
• CVE-2023-41835 - CVSS 7.5 (high), 2023-12-05: When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even…
• CVE-2023-34396 - CVSS 7.5 (high), 2023-06-14: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through…
• CVE-2023-34149 - CVSS 6.5 (medium), 2023-06-14: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through…
• CVE-2021-31805 - CVSS 9.8 (critical), 2022-04-12: The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation…
• CVE-2020-17530 - CVSS 9.8 (critical), 2020-12-11: Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 -…
• CVE-2015-2992 - CVSS 6.1 (medium), 2020-02-27: Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
• CVE-2018-11776 - CVSS 8.1 (high), 2018-08-22: Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a…
• CVE-2018-1327 - CVSS 7.5 (high), 2018-03-27: The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially…
• CVE-2017-15707 - CVSS 6.2 (medium), 2017-12-01: In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious…
• CVE-2016-6795 - CVSS 9.8 (critical), 2017-09-20: In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path…
• CVE-2017-9793 - CVSS 7.5 (high), 2017-09-20: The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform…
• CVE-2017-12611 - CVSS 9.8 (critical), 2017-09-20: In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a…
• CVE-2016-8738 - CVSS 5.9 (medium), 2017-09-20: In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a…
• CVE-2017-9804 - CVSS 7.5 (high), 2017-09-20: In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is…
• CVE-2017-9805 - CVSS 8.1 (high), 2017-09-15: The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for…
• CVE-2017-9787 - CVSS 7.5 (high), 2017-07-13: When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12…
• CVE-2017-7672 - CVSS 5.9 (medium), 2017-07-13: If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to…
• CVE-2017-9791 - CVSS 9.8 (critical), 2017-07-10: The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
• CVE-2017-5638 - CVSS 9.8 (critical), 2017-03-11: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation…