- Latest release
- 1.2.9 (Mar 23, 2006): affected by 7 advisories
- Newest unaffected release
- Every release is affected by at least one advisory
- Advisories
- 10 · 1 high, 2 medium, 1 low
- Dependents
- 102
- Releases
- 12 since 1.0.2 (Nov 22, 2005)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2025-54656Affects 1.2.9 (through the newest release)
- CVE-2023-49735Affects 1.1 to 1.2.9 (through the newest release)
- CVE-2023-34396Affects 1.0.2 to 1.2.9 (through the newest release)
- CVE-2016-1182Affects 1.0.2 to 1.2.9 (through the newest release)
- CVE-2016-1181Affects 1.0.2 to 1.2.9 (through the newest release)
- CVE-2015-0899Affects 1.1 to 1.2.9 (through the newest release)
- CVE-2008-2025Affects 1.0.2 to 1.2.9 (through the newest release)
- CVE-2006-1548Affects 1.0.2 to 1.2.8 (1.2.9 is outside it)
- CVE-2006-1547Affects 1.0.2 to 1.2.8 (1.2.9 is outside it)
- CVE-2006-1546Affects 1.0.2 to 1.2.8 (1.2.9 is outside it)
Advisories 10
- CVE-2025-54656Medium 6.5
Apache Struts Extras: Improper Output Neutralization for Logs
Affected: versions 1.2.9.
No fix released. The latest release, 1.2.9, is still affected.
Apache Tiles: Unvalidated input may lead to path traversal and XXE
Affected: from 1.1, through 1.2.9.
No fix released. The latest release, 1.2.9, is still affected.
- CVE-2023-34396Medium 4.3
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
Affected: through 1.2.9.
No fix released. The latest release, 1.2.9, is still affected.
- CVE-2016-1182Unrated
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attacke
Affected: through 1.2.9.
No fix released. The latest release, 1.2.9, is still affected.
- CVE-2016-1181Unrated
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote atta
Affected: through 1.2.9.
No fix released. The latest release, 1.2.9, is still affected.
- CVE-2015-0899Unrated
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions…
Affected: from 1.1, through 1.2.9.
No fix released. The latest release, 1.2.9, is still affected.
- CVE-2008-2025Unrated
Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on…
Affected: fixed in 1.2.9-162.31.1.
No fix released. The advisory names 1.2.9-162.31.1 as the fix, which the registry doesn't have yet. The latest release, 1.2.9, is still affected.
- CVE-2006-1548Unrated
Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache…
Affected: fixed in 1.2.9.
Fixed in 1.2.9 (released Mar 23, 2006, 7 days before disclosure).
The latest release, 1.2.9, is not affected.
- CVE-2006-1547High 7.5 · KEV
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service v
Affected: fixed in 1.2.9.
Fixed in 1.2.9 (released Mar 23, 2006, 7 days before disclosure).
The latest release, 1.2.9, is not affected.
- CVE-2006-1546Unrated
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a…
Affected: fixed in 1.2.9.
Fixed in 1.2.9 (released Mar 23, 2006, 7 days before disclosure).
The latest release, 1.2.9, is not affected.