Apache Software Foundation Apache Struts vulnerabilities
26 known vulnerabilities affecting apache_software_foundation/apache_struts.
Total CVEs
26
CISA KEV
5
actively exploited
Public exploits
9
Exploited in wild
9
Severity breakdown
CRITICAL7HIGH12MEDIUM7
Vulnerabilities
Page 2 of 2
CVE-2023-34149P3MEDIUMCVSS 6.5≤ 2.5.302023-06-14
CVE-2023-34149 [MEDIUM] CWE-770 CVE-2023-34149: Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apa
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
nvd
CVE-2016-8738P4MEDIUMCVSS 5.9v2.5 - 2.5.52017-09-20
CVE-2016-8738 [MEDIUM] CWE-20 CVE-2016-8738: In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
nvd
CVE-2015-2992P4MEDIUMCVSS 6.1vbefore 2.3.202020-02-27
CVE-2015-2992 [MEDIUM] CWE-79 CVE-2015-2992: Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
nvd
CVE-2017-15707P4MEDIUMCVSS 6.2v2.5 to 2.5.142017-12-01
CVE-2017-15707 [MEDIUM] CWE-20 CVE-2017-15707: In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulne
In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
nvd
CVE-2026-73631P4MEDIUMCVSS 4.3v7.2.12026-08-15
CVE-2026-73631 [MEDIUM] CWE-567 CVE-2026-73631: Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-req
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intended. Populating actions from a JSON request body is not
nvd
CVE-2026-73632P4MEDIUMCVSS 4.3v7.2.12026-08-15
CVE-2026-73632 [MEDIUM] CWE-567 CVE-2026-73632: Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-res
Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by
nvd
← Previous2 / 2