CVE-2016-4465

Apache Struts vulnerable to possible DoS attack when using URLValidator

5.3 MediumFix available

CVE-2016-4465 is a medium vulnerability (CVSS 5.3) in Apache Struts, published July 4, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.4%, the 95th percentile. Fixed in org.apache.struts:struts2-core 2.3.29.

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

10.4%Up 4.5 points since Feb 4, 2022

What each source reports

NVD Score used 5.3

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

Record: CVE-2016-4465
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

Record: CVE-2016-4465
Updated: 2026-11-02

EUVDEUVD-2022-5779 No score

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

Record: EUVD-2022-5779
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xg75-68x3-7p3q 5.3

Apache Struts vulnerable to possible DoS attack when using URLValidator

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.13 allows remote attackers to cause a denial of service via a null value for a URL field.

Record: GHSA-xg75-68x3-7p3q
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-20
Updated: 2026-11-02

OSV 5.3

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

Record: CVE-2016-4465
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVGHSA-xg75-68x3-7p3q 5.3

Apache Struts vulnerable to possible DoS attack when using URLValidator

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.13 allows remote attackers to cause a denial of service via a null value for a URL field.

Record: GHSA-xg75-68x3-7p3q
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-20
Updated: 2026-11-02

Affected products

apache struts

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.struts:struts2-core` Maven	2.3.20 up to 2.3.29	2.3.29
`org.apache.struts:struts2-core` Maven	2.5.0 up to 2.5.13	2.5.13
`org.apache.struts:struts2-core` Maven	2.3.20 up to 2.3.29, plus listed versions 2.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.1	2.3.29
`org.apache.struts:struts2-core` Maven	2.5.0 up to 2.5.13, plus listed versions 2.52.5.12.5.102.5.10.12.5.122.5.22.5.52.5.8	2.5.13

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 6 moreShow less