{"id":"CVE-2018-1327","aliases":["EUVD-2018-0486","GHSA-38cr-2ph5-frr9"],"status":"published","title":"Apache Struts REST Plugin can potentially allow a DoS attack","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08647,"percentile":0.95146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-91"],"published":"2018-03-27T21:00:00Z","modified":"2026-10-24T10:30:55Z","fixes":[{"ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","fixed_in":["2.5.16"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1"},{"fixed":"2.5.16"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts2-rest-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.1"},{"fixed":"2.5.16"}]}],"versions":["2.1.2","2.1.6","2.1.8","2.1.8.1","2.2.1","2.2.1.1","2.2.3","2.2.3.1","2.3.1","2.3.1.1","2.3.1.2","2.3.12","2.3.14","2.3.14.1","2.3.14.2","2.3.14.3","2.3.15","2.3.15.1","2.3.15.2","2.3.15.3","2.3.16","2.3.16.1","2.3.16.2","2.3.16.3","2.3.20","2.3.20.1","2.3.20.3","2.3.24","2.3.24.1","2.3.24.3","2.3.28","2.3.28.1","2.3.29","2.3.3","2.3.30","2.3.31","2.3.32","2.3.33","2.3.34","2.3.35","2.3.36","2.3.37","2.3.4","2.3.4.1","2.3.7","2.3.8","2.5","2.5-BETA1","2.5-BETA2","2.5-BETA3","2.5.1","2.5.10","2.5.10.1","2.5.12","2.5.13","2.5.14","2.5.14.1","2.5.2","2.5.5","2.5.8"]}],"products":[{"vendor":"apache","product":"struts"},{"vendor":"apache software foundation","product":"apache struts"}],"references":[{"url":"https://security.netapp.com/advisory/ntap-20180330-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"http://www.securitytracker.com/id/1040575","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/103516","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-056","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db%40%3Cissues.struts.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1327","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3@%3Cissues.struts.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rf482c101a88445d73cc2e89dbf7f16ae00a4aa79a544a1e72b2326db@%3Cissues.struts.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/struts/commit/4260bee634cb606be6071bce2383fddb510608aa","tags":["web"]},{"url":"https://github.com/apache/struts/commit/67ecf3a21608e20449bcb7895b22204b400fecd4","tags":["web"]},{"url":"https://github.com/apache/struts/commit/9260720568cee9e868d2899228eceed0c3359323","tags":["web"]},{"url":"https://web.archive.org/web/20200227124859/http://www.securityfocus.com/bid/103516","tags":["web"]},{"url":"https://web.archive.org/web/20200923124543/http://www.securitytracker.com/id/1040575","tags":["web"]},{"url":"https://github.com/advisories/GHSA-38cr-2ph5-frr9"},{"url":"https://github.com/apache/struts","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20180330-0001","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1327","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","status":"published","published":"2018-03-27T21:00:00Z","modified":"2024-09-16T23:11:07.229Z","updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-0486","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","status":"published","published":"2018-03-27T21:00:00Z","modified":"2024-09-16T23:11:07Z","updated_at":"2026-11-03T00:54:55.705637Z"}],"ghsa":[{"id":"GHSA-38cr-2ph5-frr9","title":"Apache Struts REST Plugin can potentially allow a DoS attack","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","status":"published","published":"2018-10-16T19:35:26Z","modified":"2024-01-05T16:06:14Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:37:29.411214Z"}],"nvd":[{"id":"CVE-2018-1327","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","status":"published","published":"2018-03-27T21:29:00.97Z","modified":"2026-06-17T01:51:01.707Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-1327","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","status":"published","published":"2018-03-27T21:29:00.97Z","modified":"2026-10-24T10:30:55.897179039Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"GHSA-38cr-2ph5-frr9","title":"Apache Struts REST Plugin can potentially allow a DoS attack","description":"The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.","status":"published","published":"2018-10-16T19:35:26Z","modified":"2024-02-20T05:31:07.975982Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}