CVE-2016-3093

Denial of service in Apache Struts

5.3 MediumFix available

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

8.44%Up 4.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.3

Record: CVE-2016-3093
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3093
Updated: 2026-11-02

EUVDEUVD-2022-2130 No score

Record: EUVD-2022-2130
Updated: 2026-11-03

GitHub AdvisoriesGHSA-383p-xqxx-rrmp 5.3

Denial of service in Apache Struts

Record: GHSA-383p-xqxx-rrmp
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-20
Updated: 2026-11-02

OSV 5.3

Record: CVE-2016-3093
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVGHSA-383p-xqxx-rrmp 5.3

Denial of service in Apache Struts

Record: GHSA-383p-xqxx-rrmp
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-20
Updated: 2026-11-02

OSVRHLW-2026-ecc1d237bc4cba0c 5.3

Lightwell Security Advisory: ognl 3.0.8.rhlw-00002

Red Hat Lightwell has released ognl:ognl 3.0.8.rhlw-00002 with a backported security fix.

CVE-2016-3093: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

This patched artifact is a drop-in replacement for ognl:ognl 3.0.8 from Maven Central.

Record: RHLW-2026-ecc1d237bc4cba0c
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts:struts2-core` Maven	2.0.0 to 2.3.24.1	2.3.24.3
`ognl:ognl` Maven	before 3.0.12	3.0.12
`org.apache.struts:struts2-core` Maven	2.0.0 up to 2.3.24.3, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 38 moreShow less 2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.32.3.42.3.4.12.3.72.3.8	2.3.24.3
`ognl:ognl` Maven	before 3.0.12, plus listed versions 2.1.42.2.22.3.22.4.12.5.1 Show 22 moreShow less 2.6.32.6.52.6.72.6.92.72.7.12.7.22.7.33.03.0.13.0.103.0.113.0.23.0.33.0.43.0.53.0.63.0.6.13.0.6.23.0.73.0.83.0.9	3.0.12
`ognl:ognl` Red Hat Lightwell:Maven	before 3.0.8.rhlw-00002, plus listed versions 2.1.42.2.22.3.22.4.12.5.1 Show 19 moreShow less 2.6.32.6.52.6.72.6.92.72.7.12.7.22.7.33.03.0.13.0.23.0.33.0.43.0.53.0.63.0.6.13.0.6.23.0.73.0.8	3.0.8.rhlw-00002

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-3093 is a medium vulnerability (CVSS 5.3) in Apache Struts, published June 7, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.44%, the 95th percentile. Fixed in org.apache.struts:struts2-core 2.3.24.3.