CVE-2016-4465

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. Fixed in 2.3.29.

CVSS 3.05.3Medium EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2.3.29Upgrade to this build

Published 2016-07-04Updated 2026-05-06Sources: CVE.org, NVD, GitHub, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Maven org.apache.struts:struts2-coreAffected: ≥ 2.3.20, < 2.3.29Upgrade to: 2.3.29Stated by: GitHub advisory
Apache Software Foundation StrutsAffected: от 2.3.20 до 2.3.28.1 включительноUpgrade to: not statedStated by: BDU

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your application uses Apache Struts (struts2-core) and identify the exact version you are running.
If you are on Apache Struts 2.3.20 through 2.3.28.1 or any 2.5.x version before 2.5.1, plan an upgrade.
Upgrade Apache Struts struts2-core to a fixed version: 2.3.29 or 2.5.1 or newer (as applicable to your release line).
After upgrading, test your key web forms/endpoints that accept URL inputs to confirm normal request handling and no recurring errors in logs.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

In plain language

Written by AI from the record

This is a bug in Apache Struts (a web app framework) where a remote attacker can crash a server by sending a specially crafted request with a missing (null) URL value; most small businesses should update if they run Struts in an affected version.

In Apache Struts (struts2-core), a remote attacker can trigger a denial of service by causing the URLValidator logic to receive a null URL field, leading to a crash/unhandled condition.

If you're affected

Website or service downtime
Requests failing during attack
Disruption to business operations

What is it

Apache Struts is like a set of building blocks many web apps use to handle web requests. In this bug, an attacker can send a request that makes the app try to validate a “missing URL value,” which can cause the app to crash or become unavailable. For a business, that means the affected website or service could stop working temporarily.

Who is affected

This matters if you run a web application built on Apache Struts (struts2-core) and your deployed Struts version is within the affected ranges. It’s only a risk when an attacker can send crafted requests to a reachable part of your app that processes a URL field. No attacker needs an account for this specific issue, but you still need network reachability to your app (for example, public web access).

How urgent is it

Treat this as a patch priority because it enables remote denial of service, meaning the attacker’s goal is to make your service unavailable. The traffic-light verdict is GREEN, so it’s not an “emergency today” situation in the absence of known active exploitation signals in the provided findings. Still, schedule the upgrade to the fixed Struts versions promptly.

What to do — in detail

Confirm exposure (what version are you running?)
- Check your application’s dependency tree for Apache Struts (struts2-core).
- Identify whether you are on:
  - 2.3.20 through 2.3.28.1, or
  - any 2.5.x before 2.5.1.
Map to fixed versions (what to upgrade to)
- Upgrade struts2-core to 2.3.29 if you’re on the 2.3 line.
- Upgrade to 2.5.1 or newer if you’re on the 2.5 line.
- (Use the same product line you’re already on; the provided patch guidance lists 2.3.29 and 2.5.1+ as fixed.)
Upgrade safely
- Apply the upgrade in a controlled change window.
- Run your application’s standard test suite and verify the endpoints/forms that accept or validate URL inputs behave normally.
If you can’t patch immediately (temporary containment)
- Reduce the exposure of the app to untrusted traffic as much as possible (for example, ensure the service is behind normal web protections and not unnecessarily exposed).
- Monitor application logs for errors around URL validation or request-handling failures.
- Prioritize scheduling the upgrade as the definitive remediation.
What to monitor after patching
- Look for reduced occurrences of exceptions related to URL validation.
- Watch for service stability during normal traffic and during any targeted testing that includes URL-field edge cases.

Technical context

Severity is assessed as medium in the provided data, with the weakness being a null value handling issue (CWE-20). The mechanism is a denial of service condition: the URLValidator in struts2-core can be driven into a bad state when it receives a null URL field from a remote request. No KEV listing was provided, and no public exploit code is on record in the findings; EPSS is predicted but the public percentage is not used in the owner-facing guidance. A fix is available: struts2-core is fixed in 2.3.29 and 2.5.1 (or newer), and the vendor guidance points to updating to those versions or later.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3733 days, from the signal feeds we watch.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

Apache Software Foundationoss-project · USaka apache foundation
- StrutsLibraryLibraryOSS Libraries / web-framework
Mavenpackage-ecosystem
- org.apache.struts:struts2-coreOSS Libraries
apacheoss-project · USaka apache http server, apache httpd
- strutsLibraryLibraryOSS Libraries / web-framework

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation