Org.apache.struts:struts2-core

This hub aggregates every CVE we track for Org.apache.struts:struts2-core, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Org.apache.struts:struts2-core.

• CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component8.1Jan 11, 2026
• CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed8.2Dec 10, 2025
• CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)7.5Dec 1, 2025
• CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks9.8Dec 11, 2024
• CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability9.8Dec 7, 2023
• CVE-2023-41835Apache Struts: excessive disk usage7.5Dec 5, 2023
• CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms4.3Jun 14, 2023
• CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list bounds4.3Jun 14, 2023
• CVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.9.8Apr 12, 2022
• CVE-2020-17530Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.KEV9.8Dec 11, 2020
• CVE-2019-0233An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.7.5Sep 14, 2020
• CVE-2019-0230Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.9.8Sep 14, 2020
• CVE-2015-2992Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.6.1Feb 27, 2020
• CVE-2012-1592A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.8.8Dec 5, 2019
• CVE-2011-3923Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.9.8Nov 1, 2019