What’s Vulnerable › Products
Apache Struts vulnerabilities
99 known vulnerabilities, 9 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.
Check whether your Apache Struts version is affected
Exploited Apache Struts vulnerabilities
- CVE-2016-3081 — Apache Struts Command Injection Vulnerability
- CVE-2013-2251 — Apache Struts Improper Input Validation Vulnerability
- CVE-2017-9791 — Apache Struts 1 Improper Input Validation Vulnerability
- CVE-2012-0391 — Apache Struts 2 Improper Input Validation Vulnerability
- CVE-2006-1547 — Apache Struts 1 ActionForm Denial-of-Service Vulnerability
- CVE-2020-17530 — Apache Struts Remote Code Execution Vulnerability
- CVE-2018-11776 — Apache Struts Remote Code Execution Vulnerability
- CVE-2017-9805 — Apache Struts Deserialization of Untrusted Data Vulnerability
- CVE-2017-5638 — Apache Struts Remote Code Execution Vulnerability
Latest Apache Struts vulnerabilities
- CVE-2026-104714 — Apache Struts: Shared message formatter exposes date and time values across concurrent requests (CVSS 8.8)
- CVE-2026-104713 — Apache Struts: Unbounded request body read in the REST plugin (CVSS 6.5)
- CVE-2026-104712 — Apache Struts: Disproportionate response size when rendering BigDecimal request parameters (CVSS 7.5)
- CVE-2026-104711 — Apache Struts: OGNL injection in the legacy RESTful action mapper (CVSS 9.8)
- CVE-2026-73635 — Apache Struts: Unbounded growth of localized-text caches driven by the request locale (CVSS 7.5)
- CVE-2026-73634 — Apache Struts: Unbounded read of a Content Security Policy violation report (CVSS 7.5)
- CVE-2026-73632 — Apache Struts: Shared serialization state in the JSON plugin (CVSS 4.3)
- CVE-2026-73631 — Apache Struts: Shared parsing state in the JSON plugin (CVSS 4.3)
- CVE-2026-73633 — Apache Struts: Unbounded read of a JSON request body (CVSS 7.5)
- CVE-2025-68493 — Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component (CVSS 8.1)
- CVE-2025-66675 — Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed (CVSS 8.2)
- CVE-2025-64775 — Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) (CVSS 7.5)
- CVE-2024-53677 — Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks (CVSS 9.8)
- CVE-2023-50164 — Apache Struts: File upload component had a directory traversal vulnerability (CVSS 9.8)
- CVE-2023-41835 — Apache Struts: excessive disk usage (CVSS 7.5)
- CVE-2023-34396 — Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms (CVSS 7.5)
- CVE-2023-34149 — Apache Struts: DoS via OOM owing to not properly checking of list bounds (CVSS 6.5)
- CVE-2021-31805 — Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. (CVSS 9.8)
- CVE-2020-26259 — XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling (CVSS 6.8)
- CVE-2020-26258 — Server-Side Forgery Request can be activated unmarshalling with XStream (CVSS 7.7)
- CVE-2020-17530 — Apache Struts Remote Code Execution Vulnerability (CVSS 9.8) — exploited
- CVE-2019-0233 — (CVSS 7.5)
- CVE-2019-0230 — (CVSS 9.8)
- CVE-2015-2992 — (CVSS 6.1)
- CVE-2012-1592 — (CVSS 8.8)