Vigie VulnDBEuropean-hosted Vulnerability DB

Apache Software Foundation Apache Struts

33 published vulnerabilities name this product.

As the CNAs write it in their CVE records (vendor and product); the versions are theirs.

CVEVulnerable versionsTitleSeverityPublishedEPSSExploitation
CVE-2026-1047142.0.0 – 2.3.37 ; 2.5.0 – 2.5.33 ; 6.0.0 – 6.11.0 ; …Apache Struts: Shared message formatter exposes date and time values across concurrent requestsHIGH 8.80.5 %
CVE-2026-1047132.1.8 – 2.3.37 ; 2.5.0 – 2.5.33 ; 6.0.0 – 6.11.0 ; …Apache Struts: Unbounded request body read in the REST pluginMEDIUM 6.50.6 %
CVE-2026-1047122.5.14 – 2.5.33 ; 6.0.0 – 6.11.0 ; 7.0.0 – 7.3.0Apache Struts: Disproportionate response size when rendering BigDecimal request parametersHIGH 7.50.8 %
CVE-2026-1047112.0.0 – 2.3.37 ; 2.5.0 – 2.5.33 ; 6.0.0 – 6.11.0 ; …Apache Struts: OGNL injection in the legacy RESTful action mapperCRITICAL 9.81.4 %
CVE-2026-736327.2.1Apache Struts: Shared serialization state in the JSON pluginMEDIUM 4.30.4 %
CVE-2026-736317.2.1Apache Struts: Shared parsing state in the JSON pluginMEDIUM 4.30.4 %
CVE-2026-736352.0.0 – 2.3.37 ; 2.5.0 – 2.5.33 ; 6.0.0 – 6.10.0 ; …Apache Struts: Unbounded growth of localized-text caches driven by the request localeHIGH 7.50.5 %
CVE-2026-736346.0.0 – 6.10.0 ; 7.0.0 – 7.2.1Apache Struts: Unbounded read of a Content Security Policy violation reportHIGH 7.50.4 %
CVE-2026-736332.1.8 – 2.3.37 ; 2.5.0 – 2.5.33 ; 6.0.0 – 6.10.0 ; …Apache Struts: Unbounded read of a JSON request bodyHIGH 7.50.7 %
CVE-2025-684932.0.0 – < 2.2.1Apache Struts, Apache Struts: XXE vulnerability in outdated XWork componentHIGH 8.150 %
CVE-2025-666752.0.0 – 6.7.* ; 7.0.0 – 7.0.*Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedHIGH 8.20.6 %
CVE-2025-647752.0.0 – 6.7.0 ; 7.0.0 – 7.0.3Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)HIGH 7.51.5 %
CVE-2024-536772.0.0 – < 6.4.0Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksCRITICAL 9.572 %
CVE-2023-501642.0.0 – 2.5.32 ; 6.0.0 – 6.3.0.1Apache Struts: File upload component had a directory traversal vulnerabilityCRITICAL 9.881 %
CVE-2023-418352.0.0 – 2.5.31 ; 6.1.2.1 – 6.3.0Apache Struts: excessive disk usageHIGH 7.57.3 %
CVE-2023-34396≤ 2.5.30 ; ≤ 6.1.2Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsHIGH 7.55.5 %
CVE-2023-34149≤ 2.5.30 ; ≤ 6.1.2Apache Struts: DoS via OOM owing to not properly checking of list boundsMEDIUM 6.55.4 %
CVE-2021-318052.0.0 to 2.5.29Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.CRITICAL 9.885 %
CVE-2020-17530Struts 2.0.0 - Struts 2.5.25Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache StCRITICAL 9.896 %KEV
CVE-2015-2992before 2.3.20Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.MEDIUM 6.15.8 %
CVE-2018-117762.3 to 2.3.34 ; 2.5 to 2.5.16Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (eiHIGH 8.1100 %KEV
CVE-2018-1327Apache Struts 2.1.1 to 2.5.14.1The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request witHIGH 7.58.6 %
CVE-2017-157072.5 to 2.5.14In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack usiMEDIUM 6.24.9 %
CVE-2017-98042.3.7 - 2.3.33 ; 2.5 - 2.5.12In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidaHIGH 7.58.2 %
CVE-2017-97932.3.7 - 2.3.33 ; 2.5 - 2.5.12 ; 2.1.x seriesThe REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerableHIGH 7.58.8 %
CVE-2017-126112.0.0 - 2.3.33 ; 2.5 - 2.5.10.1In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string liteCRITICAL 9.887 %
CVE-2016-87382.5 - 2.5.5In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is posMEDIUM 5.93.3 %
CVE-2016-67952.3.x before 2.3.31 ; 2.5.x before 2.5.5In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will beCRITICAL 9.88.2 %
CVE-2017-9805Apache Struts before 2.3.34 and 2.5.x before 2.5.13The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStreaHIGH 8.199 %KEV
CVE-2017-97872.3.x prior to 2.3.33 ; 2.5 to 2.5.10.1When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache StruHIGH 7.511 %
CVE-2017-76722.5 to 2.5.10.1If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will MEDIUM 5.99.8 %
CVE-2017-97912.1.x series ; 2.3.x seriesThe Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message tCRITICAL 9.899 %KEV
CVE-2017-56382.3.x before 2.3.32 ; 2.5.x before 2.5.10.1The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-mesCRITICAL 9.8100 %KEV