Apache Apache Struts
33 CVEs affecting Apache Apache Struts. Latest disclosed: 2026-10-05. Critical: 9, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-104711 | Critical | 9.8 | 2026-10-05 | Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the a… |
CVE-2024-53677 | Critical | 9.8 | 2024-12-11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lea… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2021-31805 | Critical | 9.8 | 2022-04-12 | The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation i… |
CVE-2020-17530 | Critical | 9.8 | 2020-12-11 | Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts… |
CVE-2017-12611 | Critical | 9.8 | 2017-09-20 | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a… |
CVE-2016-6795 | Critical | 9.8 | 2017-09-20 | In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path trav… |
CVE-2017-9791 | Critical | 9.8 | 2017-07-10 | The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. |
CVE-2017-5638 | Critical | 9.8 | 2017-03-11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation dur… |
CVE-2026-104714 | High | 8.8 | 2026-10-05 | Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a… |
CVE-2025-66675 | High | 8.2 | 2025-12-10 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0… |
CVE-2025-68493 | High | 8.1 | 2026-01-11 | Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 thr… |
CVE-2018-11776 | High | 8.1 | 2018-08-22 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a p… |
CVE-2017-9805 | High | 8.1 | 2017-09-15 | The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserializati… |
CVE-2026-104712 | High | 7.5 | 2026-10-05 | Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math… |
CVE-2026-73635 | High | 7.5 | 2026-08-15 | Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for localized-text loo… |
CVE-2026-73634 | High | 7.5 | 2026-08-15 | Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy violation reports… |
CVE-2026-73633 | High | 7.5 | 2026-08-14 | Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request… |
CVE-2025-64775 | High | 7.5 | 2025-12-01 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0… |
CVE-2023-41835 | High | 7.5 | 2023-12-05 | When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even… |