Apache Software Foundation Struts vulnerabilities

• apache struts Apache Struts: Shared message formatter exposes date and time values across concurrent requests CVE-2026-104714 8.8 HighOctober 5, 2026
• apache struts Apache Struts: Unbounded request body read in the REST plugin CVE-2026-104713 6.5 MediumOctober 5, 2026
• apache struts Apache Struts: Disproportionate response size when rendering BigDecimal request parameters CVE-2026-104712 7.5 HighOctober 5, 2026
• apache struts Apache Struts: OGNL injection in the legacy RESTful action mapper CVE-2026-104711 9.8 CriticalOctober 5, 2026
• apache struts Apache Struts: Shared serialization state in the JSON plugin CVE-2026-73632 4.3 MediumAugust 15, 2026
• apache struts Apache Struts: Shared parsing state in the JSON plugin CVE-2026-73631 4.3 MediumAugust 15, 2026
• apache struts Apache Struts: Unbounded growth of localized-text caches driven by the request locale CVE-2026-73635 7.5 HighAugust 15, 2026
• apache struts Apache Struts: Unbounded read of a Content Security Policy violation report CVE-2026-73634 7.5 HighAugust 15, 2026
• apache struts Apache Struts: Unbounded read of a JSON request body CVE-2026-73633 Public exploit 7.5 HighAugust 14, 2026
• apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 more Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component CVE-2025-68493 Public exploitFix available EPSS 50.4% 8.1 HighJanuary 11, 2026
• apache struts Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed CVE-2025-66675 Fix available 8.2 HighDecember 10, 2025
• apache struts Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) CVE-2025-64775 Fix available 7.5 HighDecember 1, 2025
• apache struts extras Apache Struts Extras: Improper Output Neutralization for Logs CVE-2025-54656 6.5 MediumJuly 30, 2025
• apache struts Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks CVE-2024-53677 Public exploitFix available EPSS 72.4% 9.5 CriticalDecember 11, 2024
• apache struts Apache Struts: File upload component had a directory traversal vulnerability CVE-2023-50164 Public exploitFix available EPSS 80.8% 9.8 CriticalDecember 7, 2023
• apache struts Apache Struts: excessive disk usage CVE-2023-41835 Fix available 7.5 HighDecember 5, 2023
• apache struts Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms CVE-2023-34396 Fix available 4.3 MediumJune 14, 2023
• apache struts Apache Struts: DoS via OOM owing to not properly checking of list bounds CVE-2023-34149 Fix available 4.3 MediumJune 14, 2023
• apache struts Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. CVE-2021-31805 Public exploitFix available EPSS 85.4% 9.8 CriticalApril 12, 2022
• apache struts, oracle business intelligence, communications diameter intelligence hub +5 more +7 more Remote code execution in Apache Struts CVE-2020-17530 In KEVPublic exploitFix available EPSS 96.3% 9.8 CriticalDecember 11, 2020
• apache struts, oracle communications policy management, financial services data integration hub +2 more +4 more Improper Preservation of Permissions in Apache Struts CVE-2019-0233 Fix available EPSS 66.1% 7.5 HighSeptember 14, 2020
• apache struts, oracle communications policy management, financial services data integration hub +2 more +4 more Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts CVE-2019-0230 Public exploitFix available EPSS 96.9% 9.8 CriticalSeptember 14, 2020
• apache struts Cross-site Scripting in Apache Struts CVE-2015-2992 Fix available 6.1 MediumFebruary 27, 2020
• apache struts, netapp active iq unified manager, oncommand insight +5 more +7 more Apache Struts vulnerable to remote command execution (RCE) due to improper input validation CVE-2018-11776 In KEVPublic exploitFix available EPSS 100.0% 8.1 HighAugust 22, 2018
• apache struts Apache Struts REST Plugin can potentially allow a DoS attack CVE-2018-1327 Fix available 7.5 HighMarch 27, 2018
• apache struts, netapp oncommand balance, oracle agile plm framework +9 more +11 more Moderate severity vulnerability that affects org.apache.struts:struts2-rest-plugin CVE-2017-15707 Fix available 6.2 MediumDecember 1, 2017
• apache struts Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used CVE-2017-9804 Fix available 7.5 HighSeptember 20, 2017
• apache struts The REST Plugin in Apache Struts is using an outdated XStream library CVE-2017-9793 Fix available 7.5 HighSeptember 20, 2017
• apache struts Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal CVE-2017-12611 Public exploitFix available EPSS 87.1% 9.8 CriticalSeptember 20, 2017
• apache struts Apache Struts vulnerable to possible DoS attack when using URLValidator CVE-2016-8738 Fix available 5.9 MediumSeptember 20, 2017
• apache struts Path Traversal in Apache Struts CVE-2016-6795 Fix available 9.8 CriticalSeptember 20, 2017
• apache struts, cisco digital media manager, hosted collaboration solution +4 more +6 more REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering CVE-2017-9805 In KEVPublic exploitFix available EPSS 99.4% 8.1 HighSeptember 15, 2017
• apache struts Spring AOP functionality (Struts) vulnerable to DoS attack CVE-2017-9787 Fix available EPSS 10.6% 7.5 HighJuly 13, 2017
• apache struts Apache Struts Improper Input Validation vulnerability CVE-2017-7672 Fix available 5.9 MediumJuly 13, 2017
• apache struts, struts 1 +1 more Code execution in Apache Struts 1 plugin CVE-2017-9791 In KEVPublic exploit EPSS 98.9% 9.8 CriticalJuly 10, 2017
• apache struts, arubanetworks clearpass policy manager, hp server automation +6 more +8 more Apache Struts vulnerable to remote arbitrary command execution due to improper input validation CVE-2017-5638 In KEVPublic exploitFix available EPSS 100.0% 9.8 CriticalMarch 11, 2017