{"id":"CVE-2016-3093","aliases":["EUVD-2022-2130","GHSA-383p-xqxx-rrmp","RHLW-2026-ecc1d237bc4cba0c"],"status":"published","title":"Denial of service in Apache Struts","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.08443,"percentile":0.95037,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-06-07T18:00:00Z","modified":"2026-10-27T04:00:18Z","fixes":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-core","fixed_in":["2.3.24.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"ognl:ognl","fixed_in":["3.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"ognl:ognl","fixed_in":["3.0.8.rhlw-00002"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.3.24.1"},{"fixed":"2.3.24.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"ognl:ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts2-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.3.24.3"}]}],"versions":["2.0.11","2.0.11.1","2.0.11.2","2.0.12","2.0.14","2.0.5","2.0.6","2.0.8","2.0.9","2.1.2","2.1.6","2.1.8","2.1.8.1","2.2.1","2.2.1.1","2.2.3","2.2.3.1","2.3.1","2.3.1.1","2.3.1.2","2.3.12","2.3.14","2.3.14.1","2.3.14.2","2.3.14.3","2.3.15","2.3.15.1","2.3.15.2","2.3.15.3","2.3.16","2.3.16.1","2.3.16.2","2.3.16.3","2.3.20","2.3.20.1","2.3.20.3","2.3.24","2.3.24.1","2.3.3","2.3.4","2.3.4.1","2.3.7","2.3.8"]},{"source":"osv","ecosystem":"Maven","package":"ognl:ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12"}]}],"versions":["2.1.4","2.2.2","2.3.2","2.4.1","2.5.1","2.6.3","2.6.5","2.6.7","2.6.9","2.7","2.7.1","2.7.2","2.7.3","3.0","3.0.1","3.0.10","3.0.11","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.6.1","3.0.6.2","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"ognl:ognl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8.rhlw-00002"}]}],"versions":["2.1.4","2.2.2","2.3.2","2.4.1","2.5.1","2.6.3","2.6.5","2.6.7","2.6.9","2.7","2.7.1","2.7.2","2.7.3","3.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.6.1","3.0.6.2","3.0.7","3.0.8"]}],"products":[{"vendor":"apache","product":"struts"},{"vendor":"ognl_project","product":"ognl"}],"references":[{"url":"http://struts.apache.org/docs/s2-034.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/90961","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1036018","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21987854","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3093","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","tags":["web"]},{"url":"https://struts.apache.org/docs/s2-034.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-383p-xqxx-rrmp","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-3093","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","status":"published","published":"2016-06-07T18:00:00Z","modified":"2024-08-05T23:40:15.648Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2022-2130","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","status":"published","published":"2016-06-07T18:00:00Z","modified":"2024-08-05T23:40:15Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-383p-xqxx-rrmp","title":"Denial of service in Apache Struts","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","status":"published","published":"2022-05-17T03:42:18Z","modified":"2024-03-14T21:50:54Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:40.81935Z"}],"nvd":[{"id":"CVE-2016-3093","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","status":"published","published":"2016-06-07T18:59:03.683Z","modified":"2026-06-17T00:44:57.577Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-3093","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","status":"published","published":"2016-06-07T18:59:03.683Z","modified":"2026-10-24T10:30:55.189162815Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"GHSA-383p-xqxx-rrmp","title":"Denial of service in Apache Struts","description":"Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.","status":"published","published":"2022-05-17T03:42:18Z","modified":"2024-03-14T22:03:08.373177Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"RHLW-2026-ecc1d237bc4cba0c","title":"Lightwell Security Advisory: ognl 3.0.8.rhlw-00002","description":"Red Hat Lightwell has released ognl:ognl 3.0.8.rhlw-00002 with a backported security fix.\n\nCVE-2016-3093: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.\n\nThis patched artifact is a drop-in replacement for ognl:ognl 3.0.8 from Maven Central.","status":"published","published":"2026-09-30T12:38:29Z","modified":"2026-10-27T04:00:18.804466917Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"}]}}