Apache Software Foundation Apache Struts

• CVE-2020-17530 Critical 9.8 Exploited Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25. 96.3%
• CVE-2018-11776 High 8.1 Exploited Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: r 100.0%
• CVE-2017-9805 High 8.1 Exploited The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can 99.4%
• CVE-2017-9791 Critical 9.8 Exploited The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. 98.9%
• CVE-2017-5638 Critical 9.8 Exploited The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows re 100.0%
• CVE-2026-104714 High 8.8 Apache Struts: Shared message formatter exposes date and time values across concurrent requests 0.5%
• CVE-2026-104713 Medium 6.5 Apache Struts: Unbounded request body read in the REST plugin 0.6%
• CVE-2026-104712 High 7.5 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters 0.8%
• CVE-2026-104711 Critical 9.8 Apache Struts: OGNL injection in the legacy RESTful action mapper 1.4%
• CVE-2026-73632 Medium 4.3 Apache Struts: Shared serialization state in the JSON plugin 0.4%
• CVE-2026-73631 Medium 4.3 Apache Struts: Shared parsing state in the JSON plugin 0.4%
• CVE-2026-73635 High 7.5 Apache Struts: Unbounded growth of localized-text caches driven by the request locale 0.5%
• CVE-2026-73634 High 7.5 Apache Struts: Unbounded read of a Content Security Policy violation report 0.4%
• CVE-2026-73633 High 7.5 Apache Struts: Unbounded read of a JSON request body 0.7%
• CVE-2025-68493 High 8.1 Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component 50.4%
• CVE-2025-66675 High 8.2 Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed 0.6%
• CVE-2025-64775 High 7.5 Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) 1.5%
• CVE-2024-53677 Critical 9.5 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks 72.4%
• CVE-2023-50164 Unrated Apache Struts: File upload component had a directory traversal vulnerability 80.8%
• CVE-2023-41835 High 7.5 Apache Struts: excessive disk usage 7.3%
• CVE-2023-34396 Medium 4.3 Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms 5.5%
• CVE-2023-34149 Medium 4.3 Apache Struts: DoS via OOM owing to not properly checking of list bounds 5.4%
• CVE-2021-31805 Unrated Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. 85.4%