Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

99 records

Vendor: Apache Component: Struts Clear all filters
TI-2026-67840 CVE-2026-104714 · GHSA-5fhf-r6vm-6wj7

Race condition in Apache Struts leaks date and time values

Priority MEDIUM 41

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00527 Published 2026-10-05 Fix deferred CWE-362
TI-2026-67839 CVE-2026-104713 · GHSA-3fxc-fh79-w9fr

Unbounded request body read in Apache Struts REST plugin

Priority LOW 30

Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0056 Published 2026-10-05 No fix listed CWE-770
TI-2026-67837 CVE-2026-104711 · GHSA-wfm5-pq4p-gff9

Expression language injection in Apache Struts legacy RESTful mapper

Priority MEDIUM 52

Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01394 Published 2026-10-05 No fix listed CWE-917
TI-2026-51715 CVE-2026-73631 · GHSA-gvf6-rf7m-9h3g

Apache Struts: Shared parsing state in the JSON plugin

Priority LOW 20

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00375 Published 2026-08-15 No fix listed CWE-567
TI-2026-51717 CVE-2026-73633 · GHSA-335q-cpqh-m68h

Apache Struts: Unbounded read of a JSON request body

Priority MEDIUM 40

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00698 Published 2026-08-14 No fix listed CWE-400
TI-2023-27406 CVE-2023-50164 · GHSA-2j39-qcjm-428w

Apache Struts: File upload component had a directory traversal vulnerability

Priority CRITICAL 89

An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.80819 Published 2023-12-07 Fixed in 2.5.33, 6.3.0.2 CWE-552
TI-2023-22231 CVE-2023-41835 · GHSA-729q-fcgp-r5xh

Apache Struts: excessive disk usage

Priority MEDIUM 49

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.073 Published 2023-12-05 Fixed in 6.3.0.1, 6.1.2.2 +1 CWE-459
TI-2023-16993 CVE-2023-34149 · GHSA-8f6x-v685-g2xc

Apache Struts: DoS via OOM owing to not properly checking of list bounds

Priority LOW 37

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.05448 Published 2023-06-14 Fixed in 2.5.31, 6.1.2.1 CWE-770
TI-2020-13278 CVE-2020-17530 · GHSA-jc35-q369-45pv

Expression language injection in Apache Struts

Priority CRITICAL 100KEV

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96251 Published 2020-12-11 Fixed in 2.5.26 CWE-917
TI-2019-00203 CVE-2019-0230 · GHSA-wp4h-pvgw-5727

Prototype pollution in Apache Struts

Priority CRITICAL 86

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96946 Published 2020-09-14 Partial fix · 2.5.22 CWE-1321
TI-2012-01383 CVE-2012-1592 · GHSA-8m5q-crqq-6pmf

Unrestricted file upload in libstruts1.2-java

Priority MEDIUM 61

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.2855 Published 2019-12-05 Fixed in 2.5.22 CWE-434
Load more