Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Struts

33 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-73633 Public exploit

    Apache Struts: Unbounded read of a JSON request body

    Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single r…

    Apache Software Foundation Apache Struts
  • High 8.1
    CVE-2025-68493 Public exploit EPSS 50%

    Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • High 8.1
    CVE-2018-11776 Exploited Public exploit EPSS 100%

    Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

    Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upp…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • High 8.1
    CVE-2017-9805 Exploited Public exploit EPSS 99%

    REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
    KEV Nov 3, 2021