Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.struts:struts2-rest-plugin

6 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
7.4.0 (Sep 17, 2026): no advisory affects it
Newest unaffected release
7.4.0 (Sep 17, 2026), the latest release
Advisories
6 · 1 high
Dependents
2
Releases
103 since 2.1.2 (May 25, 2008)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2018-1327
    Affects 2.1.2 to 2.5.14.1 (2.5.16 is outside it)
  • CVE-2017-15707
    Affects 2.5 to 2.5.14.1 (2.5.16 is outside it)
  • CVE-2017-9793
    Affects 2.1.2 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it)
  • CVE-2017-9805
    Affects 2.1.2 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it)
  • CVE-2016-4438
    Affects 2.3.20 to 2.3.28.1 (2.3.29 is outside it)
  • CVE-2013-4316
    Affects 2.1.2 to 2.3.15.1 (2.3.15.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request…

    Affected: from 2.1.1, fixed in 2.5.16.

    Fixed in 2.5.16 (released Mar 2, 2018, 25 days before disclosure).

    The latest release, 7.4.0, is not affected.

  • In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack…

    Affected: from 2.5.0, fixed in 2.5.16.

    Fixed in 2.5.16 (released Mar 2, 2018, 91 days after disclosure).

    The latest release, 7.4.0, is not affected.

  • The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is…

    Affected: fixed in 2.3.34; from 2.5.0, fixed in 2.5.13.

    Fixed in 2.3.34 (released Sep 5, 2017, 15 days before disclosure) and 2.5.13 (released Aug 23, 2017, 28 days before disclosure).

    The latest release, 7.4.0, is not affected.

  • CVE-2017-9805High 8.1 · KEV

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

    Affected: from 2.1.1, fixed in 2.3.34; from 2.5.0, fixed in 2.5.13.

    Fixed in 2.3.34 (released Sep 5, 2017, 10 days before disclosure) and 2.5.13 (released Aug 23, 2017, 23 days before disclosure).

    The latest release, 7.4.0, is not affected.

  • The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

    Affected: from 2.3.19, fixed in 2.3.29.

    Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure).

    The latest release, 7.4.0, is not affected.

  • Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

    Affected: from 2.0.0, fixed in 2.3.15.2.

    Fixed in 2.3.15.2 (released Sep 18, 2013, 12 days before disclosure).

    The latest release, 7.4.0, is not affected.