{"id":"CVE-2025-54656","aliases":["CLSA-2025-1754006692","CLSA-2026-1788410329","EUVD-2025-23173","GHSA-cx25-xg7c-xfm5"],"status":"published","title":"Apache Struts Extras: Improper Output Neutralization for Logs","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.\n\nThis issue affects Apache Struts Extras: before 2.\n\nWhen using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). \n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00671,"percentile":0.52321,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-117"],"published":"2025-07-30T15:58:02Z","modified":"2026-11-02T19:58:34Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.struts:struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"struts:struts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.9"},{"last_affected":"1.2.9"}]}],"versions":["1.2.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.struts:struts-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.5"},{"fixed":"1.3.5-tuxcare.1"}]}],"versions":["1.3.5"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.struts:struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.5"},{"fixed":"1.3.5-tuxcare.1"}]}],"versions":["1.3.5"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.apache.struts:struts-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.10"}]}],"versions":["1.3.10","1.3.5","1.3.8","1.3.9"]},{"source":"osv","ecosystem":"Maven","package":"struts:struts","versions":["1.2.9"]}],"products":[{"vendor":"apache","product":"struts_extras"},{"vendor":"apache software foundation","product":"apache struts extras"}],"references":[{"url":"https://lists.apache.org/thread/so5cn07j2zn9vlf1xnfqp630wts719rr","tags":["vendor-advisory","Mailing List","Vendor Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/07/30/1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54656","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cx25-xg7c-xfm5"},{"url":"https://github.com/apache/struts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-54656","title":"Apache Struts Extras: Improper Output Neutralization for Logs","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.\n\nThis issue affects Apache Struts Extras: before 2.\n\nWhen using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). \n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-07-30T15:58:02.362Z","modified":"2025-11-04T21:12:51.678Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-23173","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.\n\nThis issue affects Apache Struts Extras: before 2.\n\nWhen using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). \n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-07-30T15:58:02Z","modified":"2025-11-04T21:12:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-cx25-xg7c-xfm5","title":"Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.\n\nThis issue affects Apache Struts Extras: before 2.\n\nWhen using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). \n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-07-30T18:31:36Z","modified":"2025-11-14T22:46:52Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"nvd":[{"id":"CVE-2025-54656","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.\n\nThis issue affects Apache Struts Extras: before 2.\n\nWhen using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). \n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-07-30T16:15:28.693Z","modified":"2026-06-17T09:40:29.18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"GHSA-cx25-xg7c-xfm5","title":"Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability","description":"** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.\n\nThis issue affects Apache Struts Extras: before 2.\n\nWhen using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). \n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2025-07-30T18:31:36Z","modified":"2025-11-14T23:09:54.325221Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-117"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"CLSA-2025-1754006692","title":"TuxCare security update for org.apache.struts (5 CVEs)","description":"TuxCare rebuilt 2 org.apache.struts packages to address 5 CVEs. Fixed in 1.3.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:58:34.022004801Z","updated_at":"2026-11-02T20:23:44.164659Z"},{"id":"CLSA-2026-1788410329","title":"TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)","description":"TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.5-tuxcare.1.","status":"withdrawn","published":"2026-09-03T04:38:49Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}