ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17530 In wildKEV | 9.8 | Dec 11 | Apache Struts Remote Code Execution Vulnerability Affected: Struts 2.0.0 - Struts 2.5.25 |
| CVE-2017-9791 In wildKEV | 9.8 | Jul 10 | The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage Affected: 2.1.x series; 2.3.x series |
| CVE-2017-5638 RansomwareIn wildKEV | 9.8 | Mar 11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload… Affected: 2.3.x before 2.3.32; 2.5.x before 2.5.10.1 |
| CVE-2013-2251 In wildKEV | 9.8 | Jul 18 | Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction:… Affected: 2.0.0 through 2.3.15 |
| CVE-2012-0391 In wildKEV | 9.8 | Jan 8 | The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of… Affected: before 2.2.3.1 |
| CVE-2018-11776 In wildKEV | 8.1 | Aug 22 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like… Affected: 2.3 to 2.3.34; 2.5 to 2.5.16 |
| CVE-2017-9805 In wildKEV | 8.1 | Sep 15 | The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type… Affected: Apache Struts before 2.3.34 and 2.5.x before 2.5.13 |
| CVE-2016-3081 In wildKEV | 8.1 | Apr 26 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method:… Affected: 2.3.20 before 2.3.20.3; 2.3.21 before 2.3.24.3; 2.3.25 before 2.3.28.1 |
| CVE-2006-1547 In wildKEV | 7.5 | Mar 30 | ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form… Affected: before 1.2.9 |
| CVE-2026-104711 | 9.8 | Oct 5 | Apache Struts: OGNL injection in the legacy RESTful action mapper Affected: 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 |
| CVE-2024-53677 | 9.8 | Dec 11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a… Affected: 2.0.0 before 6.4.0 |
| CVE-2023-50164 | 9.8 | Dec 7 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform… Affected: 2.0.0 before 2.5.33; 6.0.0 before 6.3.0.2 |
| CVE-2021-31805 | 9.8 | Apr 12 | The fix issued for CVE-2020-17530 was incomplete Affected: 2.0.0 through 2.5.29 |
| CVE-2019-0230 | 9.8 | Sep 14 | Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution Affected: 2.0.0 through 2.5.20 |
| CVE-2011-3923 | 9.8 | Nov 1 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands Affected: 2.0.0 before 2.3.1.2 |
| CVE-2017-12611 | 9.8 | Sep 20 | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +34 more |
| CVE-2016-6795 | 9.8 | Sep 20 | In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution… Affected: 2.3.20; 2.3.20.1; 2.3.20.2; 2.3.20.3; 2.3.21; 2.3.22; +12 more |
| CVE-2016-4436 | 9.8 | Oct 3 | Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2016-4438 | 9.8 | Jul 4 | The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +1 more |
| CVE-2016-3087 | 9.8 | Jun 7 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors… Affected: 2.3.20; 2.3.20.1; 2.3.24; 2.3.24.1; 2.3.28 |
| CVE-2016-3082 | 9.8 | Apr 26 | XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2026-104714 | 8.8 | Oct 5 | Apache Struts: Shared message formatter exposes date and time values across concurrent requests Affected: 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 |
| CVE-2012-1592 | 8.8 | Dec 5 | A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files Affected: 2.0.0 |
| CVE-2016-3090 | 8.8 | Oct 30 | The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +34 more |
| CVE-2016-4461 | 8.8 | Oct 16 | Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation Affected: 2.0.0 before 2.3.29 |
| CVE-2016-4430 | 8.8 | Jul 4 | Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +2 more |
| CVE-2016-0785 | 8.8 | Apr 12 | Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation Affected: 2.0.0 before 2.3.20.3; 2.3.21 through 2.3.24.1 |
| CVE-2025-66675 | 8.2 | Dec 10 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion Affected: 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 before 6.8.0; 7.0.0 before 7.1.1 |
| CVE-2016-1182 | 8.2 | Jul 4 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting… Affected: 1.0; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +22 more |
| CVE-2025-68493 | 8.1 | Jan 11 | Missing XML Validation vulnerability in Apache Struts, Apache Struts Affected: 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 before 6.1.1 |
| CVE-2016-1181 | 8.1 | Jul 4 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or… Affected: 1.0; 1.0; 1.0; 1.0; 1.0.1; 1.0.2; +22 more |
| CVE-2013-2115 | 8.1 | Jul 10 | Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in… Affected: 2.0.0 through 2.3.14.1 |
| CVE-2020-26258 | 7.7 | Dec 16 | Server-Side Forgery Request can be activated unmarshalling with XStream Affected: before 6.0.0 |
| CVE-2026-104712 | 7.5 | Oct 5 | Apache Struts: Disproportionate response size when rendering BigDecimal request parameters Affected: 2.5.14 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 |
| CVE-2026-73635 | 7.5 | Aug 15 | Apache Struts: Unbounded growth of localized-text caches driven by the request locale Affected: 2.0.0 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.10.0; 7.0.0 through 7.2.1 |
| CVE-2026-73634 | 7.5 | Aug 15 | Apache Struts: Unbounded read of a Content Security Policy violation report Affected: 6.0.0 through 6.10.0; 7.0.0 through 7.2.1 |
| CVE-2026-73633 | 7.5 | Aug 14 | Apache Struts: Unbounded read of a JSON request body Affected: 2.1.8 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.10.0; 7.0.0 through 7.2.1 |
| CVE-2025-64775 | 7.5 | Dec 1 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion Affected: 2.0.0 before 6.8.0; 7.0.0 before 7.1.1 |
| CVE-2023-41835 | 7.5 | Dec 5 | When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has… Affected: 2.0.0 before 2.5.32; 6.1.2.1 before 6.3.0.1 |
| CVE-2023-34396 | 7.5 | Jun 14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2 Affected: before 2.5.31; 6.0.0 before 6.1.2.1 |
| CVE-2019-0233 | 7.5 | Sep 14 | An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload Affected: 2.0.0 through 2.5.20 |
| CVE-2018-1327 | 7.5 | Mar 27 | The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload Affected: 2.1.1 through 2.5.14.1 |
| CVE-2017-9804 | 7.5 | Sep 20 | In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare… Affected: 2.3.7; 2.3.8; 2.3.9; 2.3.10; 2.3.11; 2.3.12; +34 more |
| CVE-2017-9793 | 7.5 | Sep 20 | The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using… Affected: 2.3.7; 2.3.8; 2.3.9; 2.3.10; 2.3.11; 2.3.12; +34 more |
| CVE-2015-5209 | 7.5 | Aug 29 | Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2017-9787 | 7.5 | Jul 13 | When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack Affected: 2.3.7; 2.3.8; 2.3.9; 2.3.10; 2.3.11; 2.3.12; +34 more |
| CVE-2016-4433 | 7.5 | Jul 4 | Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +1 more |
| CVE-2016-4431 | 7.5 | Jul 4 | Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +1 more |
| CVE-2015-0899 | 7.5 | Jul 4 | The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter Affected: 1.0; 1.0.2; 1.1; 1.1; 1.1; 1.1; +11 more |
| CVE-2020-26259 | 6.8 | Dec 16 | XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling Affected: before 6.0.0 |