Every CVE Search/ Get API key

CVE-2016-1181

Improper Input Validation in Apache Struts

8.1 High

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

12.7%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.1

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Record
CVE-2016-1181
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Record
CVE-2016-1181
Updated
2026-11-02
EUVDEUVD-2022-3025 No score

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Record
EUVD-2022-3025
Updated
2026-11-02
GitHub AdvisoriesGHSA-7jw3-5q4w-89qg 8.1

Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Record
GHSA-7jw3-5q4w-89qg
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 8.1

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Record
CVE-2016-1181
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-7jw3-5q4w-89qg 8.1

Improper Input Validation in Apache Struts

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.

Record
GHSA-7jw3-5q4w-89qg
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVCLSA-2025-1754006692 No score

TuxCare security update for org.apache.struts (5 CVEs)

TuxCare rebuilt 2 org.apache.struts packages to address 5 CVEs. Fixed in 1.3.5-tuxcare.1.

Record
CLSA-2025-1754006692
Updated
2026-11-02
OSVCLSA-2026-1788410329 No score

TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)

TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.

Record
CLSA-2026-1788410329
Updated
2026-11-02
OSVMGASA-2016-0244 No score

Updated struts packages fix security vulnerabilities

Updated struts packages fix security vulnerabilities:

A vulnerability in Apache Struts 1 ActionForm allowing unintended remote operations against components on server memory, such as Servlets and ClassLoader, was found (CVE-2016-1181).

It was reported that The Apache Struts 1 Validator contains a vulnerability where input validation configurations (validation rules, error messages, etc.) may be modified. This occurs when ValidatorForm and ValidatorActionForm (including its subclasses) are in the session scope (CVE-2016-1182).

Record
MGASA-2016-0244
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.struts:struts-core
Maven
 through 1.3.10 None known
struts:struts
Maven
 through 1.2.9 None known
org.apache.struts:struts-core
TuxCare:Maven
From an advisory covering 5 CVEs
 1.3.5 up to 1.3.5-tuxcare.1
1.3.5-tuxcare.1
org.apache.struts:struts-extras
TuxCare:Maven
From an advisory covering 5 CVEs
 1.3.5 up to 1.3.5-tuxcare.1
1.3.5-tuxcare.1
org.apache.struts:struts-core
Maven
 through 1.3.10, plus listed versions
1.3.51.3.81.3.9
 None known
struts:struts
Maven
 through 1.2.9, plus listed versions
1.0.21.11.1-b2-200211241.1-b31.1-beta-2
Show 6 moreShow less
1.1-rc11.1-rc21.2.21.2.41.2.71.2.8
 None known
struts
Mageia:5
From an advisory covering 2 CVEs
 before 1.3.10-8.2.mga5
1.3.10-8.2.mga5

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-1181 is a high vulnerability (CVSS 8.1) in Apache Struts, published July 4, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.7%, the 96th percentile. No source names a fixed version.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open