Read the docs
TI-2025-34426 Aliases CVE-2025-54656GHSA-cx25-xg7c-xfm5

Apache Struts Extras: Improper Output Neutralization for Logs

Priority LOW 36CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated).  As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00671 52nd percentileScored 2026-11-07
Fix Fixed Apache Struts Extras (Apache Software Foundation): 2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Struts Extrasbefore 22Patch availableCNA
—org.apache.struts:struts-extras (Maven)up to 1.3.10—No fix listedGHSA-cx25-xg7c-xfm5
—struts:struts (Maven)——No fix listedGHSA-cx25-xg7c-xfm5
  • Apache Struts Extras VendorApache Affected before 2 Fixed in 2 Patch available CNA
  • org.apache.struts:struts-extras (Maven) Vendor— Affected up to 1.3.10 Fixed in — No fix listed GHSA-cx25-xg7c-xfm5
  • struts:struts (Maven) Vendor— Affected — Fixed in — No fix listed GHSA-cx25-xg7c-xfm5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts_extras:*:*:*:*:*:*:*:*before 2.0VulnerableApache
  • cpe:2.3:a:apache:struts_extras:*:*:*:*:*:*:*:* Versions before 2.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Struts Extras (Apache Software Foundation) Fixed in 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54656
  2. 2026-10-03 Alias added: GHSA-cx25-xg7c-xfm5
  3. 2026-10-31 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences