Apache struts

This hub aggregates every CVE we track for Apache struts, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache struts.

• CVE-2026-73632Apache Struts: Shared serialization state in the JSON plugin4.3Aug 15, 2026
• CVE-2026-73631Apache Struts: Shared parsing state in the JSON plugin4.3Aug 15, 2026
• CVE-2026-73635Apache Struts: Unbounded growth of localized-text caches driven by the request locale7.5Aug 15, 2026
• CVE-2026-73634Apache Struts: Unbounded read of a Content Security Policy violation report7.5Aug 15, 2026
• CVE-2026-73633Apache Struts: Unbounded read of a JSON request body7.5Aug 14, 2026
• CVE-2025-68493Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component8.1Jan 11, 2026
• CVE-2025-66675Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed8.2Dec 10, 2025
• CVE-2025-64775Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)7.5Dec 1, 2025
• CVE-2025-29868Apache Answer: Using externally referenced images can leak user privacy.6.5Apr 1, 2025
• CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks9.8Dec 11, 2024
• CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability9.8Dec 7, 2023
• CVE-2023-41835Apache Struts: excessive disk usage7.5Dec 5, 2023
• CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms4.3Jun 14, 2023
• CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list bounds4.3Jun 14, 2023
• CVE-2021-31805Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.9.8Apr 12, 2022