Product by Apache Software Foundation

    Apache Struts

    33 known vulnerabilities in Apache Struts (Apache Software Foundation), 5 of them actively exploited (CISA KEV).

    Key figures

    33

    Vulnerabilities

    5

    Actively exploited (KEV)

    1

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Struts (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    CriticalCVE-2017-5638

    Apache Struts Remote Code Execution Vulnerability

    In CISA KEVRansomware

    		9.8
    CriticalCVE-2017-9791

    Apache Struts 1 Improper Input Validation Vulnerability

    In CISA KEV

    		9.8
    CriticalCVE-2020-17530

    Apache Struts Remote Code Execution Vulnerability

    In CISA KEV

    		9.8
    CriticalCVE-2018-11776

    Apache Struts Remote Code Execution Vulnerability

    In CISA KEV

    		8.1
    CriticalCVE-2017-9805

    Apache Struts Deserialization of Untrusted Data Vulnerability

    In CISA KEV

    		8.1
    CriticalCVE-2024-53677

    Apache Struts: Remote Code Execution

    		9.8
    CriticalCVE-2023-50164

    Apache Struts: File upload component had a directory traversal vulnerability

    		9.8
    HighCVE-2025-68493

    Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    		8.1
    CriticalCVE-2021-31805

    Apache Struts: Expression Language Injection

    		9.8
    CriticalCVE-2017-12611

    Apache Struts: Remote Code Execution

    		9.8
    CriticalCVE-2016-6795

    Apache Struts: Path Traversal

    		9.8
    CriticalCVE-2026-104711

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    		9.8
    HighCVE-2023-41835

    Apache Struts: excessive disk usage

    		7.5
    HighCVE-2017-9787

    Apache Struts: security vulnerability

    		7.5
    HighCVE-2017-9793

    Apache Struts: security vulnerability

    		7.5
    HighCVE-2018-1327

    Apache Struts: security vulnerability

    		7.5
    HighCVE-2017-9804

    Apache Struts: security vulnerability

    		7.5
    HighCVE-2023-34396

    Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms

    		4.3
    MediumCVE-2023-34149

    Apache Struts: DoS via OOM owing to not properly checking of list bounds

    		4.3
    MediumCVE-2017-7672

    Apache Struts: security vulnerability

    		5.9
    MediumCVE-2015-2992

    Apache Struts: Cross-Site Scripting (XSS)

    		6.1
    MediumCVE-2017-15707

    Apache Struts: security vulnerability

    		6.2
    HighCVE-2026-104712

    Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

    		7.5
    HighCVE-2026-104714

    Apache Struts: Shared message formatter exposes date and time values across concurrent requests

    		8.8
    HighCVE-2025-64775

    Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)

    		7.5

    All vulnerabilities in search

    All products by Apache Software Foundation