# org.apache.struts:struts2-rest-plugin (Maven) vulnerabilities

6 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 7.4.0 (Sep 17, 2026): no advisory affects it
- Newest unaffected release: 7.4.0 (Sep 17, 2026), the latest release
- Dependents: 2
- Releases: 103 since 2.1.2 (May 25, 2008)
- Registry: https://central.sonatype.com/artifact/org.apache.struts/struts2-rest-plugin
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2018-1327: 2.1.2 to 2.5.14.1 (2.5.16 is outside it)
- CVE-2017-15707: 2.5 to 2.5.14.1 (2.5.16 is outside it)
- CVE-2017-9793: 2.1.2 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it)
- CVE-2017-9805: 2.1.2 to 2.3.33 (2.3.34 is outside it); 2.5 to 2.5.12 (2.5.13 is outside it)
- CVE-2016-4438: 2.3.20 to 2.3.28.1 (2.3.29 is outside it)
- CVE-2013-4316: 2.1.2 to 2.3.15.1 (2.3.15.2 is outside it)

## Advisories (6)

### [CVE-2018-1327](https://cve.now/CVE-2018-1327): The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request…

- Severity: Unrated
- Published: Mar 27, 2018
- Affected: from 2.1.1, fixed in 2.5.16.
- Fixed in 2.5.16 (released Mar 2, 2018, 25 days before disclosure).
- The latest release, 7.4.0, is not affected.

### [CVE-2017-15707](https://cve.now/CVE-2017-15707): In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack…

- Severity: Unrated
- Published: Dec 1, 2017
- Affected: from 2.5.0, fixed in 2.5.16.
- Fixed in 2.5.16 (released Mar 2, 2018, 91 days after disclosure).
- The latest release, 7.4.0, is not affected.

### [CVE-2017-9793](https://cve.now/CVE-2017-9793): The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is…

- Severity: Unrated
- Published: Sep 20, 2017
- Affected: fixed in 2.3.34; from 2.5.0, fixed in 2.5.13.
- Fixed in 2.3.34 (released Sep 5, 2017, 15 days before disclosure) and 2.5.13 (released Aug 23, 2017, 28 days before disclosure).
- The latest release, 7.4.0, is not affected.

### [CVE-2017-9805](https://cve.now/CVE-2017-9805): The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStrea

- Severity: High 8.1 · KEV
- Published: Sep 15, 2017
- Affected: from 2.1.1, fixed in 2.3.34; from 2.5.0, fixed in 2.5.13.
- Fixed in 2.3.34 (released Sep 5, 2017, 10 days before disclosure) and 2.5.13 (released Aug 23, 2017, 23 days before disclosure).
- The latest release, 7.4.0, is not affected.

### [CVE-2016-4438](https://cve.now/CVE-2016-4438): The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

- Severity: Unrated
- Published: Jul 4, 2016
- Affected: from 2.3.19, fixed in 2.3.29.
- Fixed in 2.3.29 (released Jun 14, 2016, 20 days before disclosure).
- The latest release, 7.4.0, is not affected.

### [CVE-2013-4316](https://cve.now/CVE-2013-4316): Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.

- Severity: Unrated
- Published: Sep 30, 2013
- Affected: from 2.0.0, fixed in 2.3.15.2.
- Fixed in 2.3.15.2 (released Sep 18, 2013, 12 days before disclosure).
- The latest release, 7.4.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.struts:struts2-rest-plugin
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.