Apache Struts
- Software type
- Web framework
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/07/2026, Apache Struts recorded 9 security vulnerabilities in the last 90 days, of which 6 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Struts and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requestsCVE-2026-104713Apache Struts: Unbounded request body read in the REST pluginCVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parametersCVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapperCVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request locale| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requests | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-104713Apache Struts: Unbounded request body read in the REST plugin | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parameters | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityHigh |
|---|
CVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapper | Exploitation statusNot exploited | FixYes | Published10/05/2026 | SeverityCritical |
|---|
CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request locale | Exploitation statusNot exploited | FixYes | Published08/15/2026 | SeverityHigh |
|---|
CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation report | Exploitation statusNot exploited | FixYes | Published08/15/2026 | SeverityHigh |
|---|
CVE-2026-73632Apache Struts: Shared serialization state in the JSON plugin | Exploitation statusNot exploited | FixNo | Published08/15/2026 | SeverityMedium |
|---|
CVE-2026-73631Apache Struts: Shared parsing state in the JSON plugin | Exploitation statusNot exploited | FixNo | Published08/15/2026 | SeverityMedium |
|---|
CVE-2026-73633Apache Struts: Unbounded read of a JSON request body | Exploitation statusNot exploited | FixYes | Published08/14/2026 | SeverityHigh |
|---|
CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component | Exploitation statusNot exploited | FixYes | Published01/11/2026 | SeverityHigh |
|---|
CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed | Exploitation statusNot exploited | FixYes | Published12/10/2025 | SeverityHigh |
|---|
CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) | Exploitation statusNot exploited | FixYes | Published12/01/2025 | SeverityHigh |
|---|
CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks | Exploitation statusActively exploited | FixYes | Published12/11/2024 | SeverityCritical |
|---|
CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability | Exploitation statusActively exploited | FixYes | Published12/07/2023 | SeverityUnknown |
|---|
CVE-2023-41835Apache Struts: excessive disk usage | Exploitation statusNot exploited | FixYes | Published12/05/2023 | SeverityHigh |
|---|
CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms | Exploitation statusNot exploited | FixNo | Published06/14/2023 | SeverityMedium |
|---|
CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list bounds | Exploitation statusNot exploited | FixNo | Published06/14/2023 | SeverityMedium |
|---|
CVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE. | Exploitation statusNot confirmed | FixNo | Published04/12/2022 | SeverityUnknown |
|---|
CVE-2020-17530CVE-2020-17530 | Exploitation statusKEV | FixNo | Published12/11/2020 | SeverityCritical |
|---|
CVE-2015-2992CVE-2015-2992 | Exploitation statusNot confirmed | FixNo | Published02/27/2020 | SeverityUnknown |
|---|
CVE-2018-11776CVE-2018-11776 | Exploitation statusKEV | FixNo | Published08/22/2018 | SeverityHigh |
|---|
CVE-2018-1327CVE-2018-1327 | Exploitation statusNot confirmed | FixNo | Published03/27/2018 | SeverityUnknown |
|---|
CVE-2017-15707CVE-2017-15707 | Exploitation statusNot confirmed | FixNo | Published12/01/2017 | SeverityUnknown |
|---|
CVE-2017-9804CVE-2017-9804 | Exploitation statusNot confirmed | FixNo | Published09/20/2017 | SeverityUnknown |
|---|
CVE-2017-9793CVE-2017-9793 | Exploitation statusNot confirmed | FixNo | Published09/20/2017 | SeverityUnknown |
|---|
CVE-2017-12611CVE-2017-12611 | Exploitation statusNot confirmed | FixNo | Published09/20/2017 | SeverityUnknown |
|---|
CVE-2016-8738CVE-2016-8738 | Exploitation statusNot confirmed | FixNo | Published09/20/2017 | SeverityUnknown |
|---|
CVE-2016-6795CVE-2016-6795 | Exploitation statusNot confirmed | FixNo | Published09/20/2017 | SeverityUnknown |
|---|
CVE-2017-9805CVE-2017-9805 | Exploitation statusKEV | FixNo | Published09/15/2017 | SeverityHigh |
|---|
CVE-2017-9787CVE-2017-9787 | Exploitation statusNot confirmed | FixNo | Published07/13/2017 | SeverityUnknown |
|---|
CVE-2017-7672CVE-2017-7672 | Exploitation statusNot confirmed | FixNo | Published07/13/2017 | SeverityUnknown |
|---|
CVE-2017-9791CVE-2017-9791 | Exploitation statusKEV | FixNo | Published07/10/2017 | SeverityCritical |
|---|
CVE-2017-5638CVE-2017-5638 | Exploitation statusKEV | FixNo | Published03/11/2017 | SeverityCritical |
|---|
33 Results | Page 1 of 1