CVE-2012-4387
Denial of service in Apache Struts
CVE-2012-4387 is a medium vulnerability (CVSS 5.0) in Apache Struts, published September 5, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.14%, the 94th percentile. Fixed in org.apache.struts.xwork:xwork-core 2.3.4.1.
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
Exploit likelihood
What each source reports
NVD Score used
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
CVE-2012-4387- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
CVE-2012-4387- Updated
- 2026-11-02
EUVDEUVD-2022-4209 No score
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
EUVD-2022-4209- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hrgc-54mv-58gv No score
Denial of service in Apache Struts
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
GHSA-hrgc-54mv-58gv- Updated
- 2026-11-02
OSVGHSA-hrgc-54mv-58gv No score
Denial of service in Apache Struts
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
- Record
GHSA-hrgc-54mv-58gv- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts.xwork:xwork-coreMaven |
2.0.0 up to 2.3.4.1 | 2.3.4.1 |
org.apache.struts.xwork:xwork-coreMaven |
2.0.0 up to 2.3.4.1, plus listed versions 2.2.12.2.1.12.2.32.2.3.12.3.1 Show 4 moreShow less2.3.1.12.3.1.22.3.32.3.4 |
2.3.4.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
exchange.xforce.ibmcloud.com/vulnerabilities/78183
struts.apache.org/2.x/docs/s2-011.html
openwall.com/lists/oss-security/2012/09/01/5
secunia.com/advisories/50420
securityfocus.com/bid/55346
issues.apache.org/jira/browse/WW-3860