CVE Tools
Track your stack

Apache Struts

101 CVEs tracked. 9 of them are in CISA KEV.

This hub aggregates every CVE we track for Apache Struts, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Struts CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Struts CVEs per month
MonthCVEs
2024-121
2025-010
2025-020
2025-030
2025-041
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-122
2026-011
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-085
2026-090
2026-104
2026-110

Severity

How the 101 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2424%
  • High3535%
  • Medium4141%
  • Low11%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Struts.

  1. CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requests8.8
  2. CVE-2026-104713Apache Struts: Unbounded request body read in the REST plugin6.5
  3. CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parameters7.5
  4. CVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapper9.8
  5. CVE-2026-73632Apache Struts: Shared serialization state in the JSON plugin4.3
  6. CVE-2026-73631Apache Struts: Shared parsing state in the JSON plugin4.3
  7. CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request locale7.5
  8. CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation report7.5
  9. CVE-2026-73633Apache Struts: Unbounded read of a JSON request body7.5
  10. CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component8.1
  11. CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed8.2
  12. CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)7.5
  13. CVE-2025-29868Apache Answer: Using externally referenced images can leak user privacy.6.5
  14. CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks9.8
  15. CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability9.8

Product grouping is registry-driven, with AI assist and human review. How it works