# struts:struts (Maven) vulnerabilities 10 known vulnerabilities (1 high, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.2.9 (Mar 23, 2006): affected by 7 advisories - Newest unaffected release: Every release is affected by at least one advisory - Dependents: 102 - Releases: 12 since 1.0.2 (Nov 22, 2005) - Registry: https://central.sonatype.com/artifact/struts/struts - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-54656: 1.2.9 (through the newest release) - CVE-2023-49735: 1.1 to 1.2.9 (through the newest release) - CVE-2023-34396: 1.0.2 to 1.2.9 (through the newest release) - CVE-2016-1182: 1.0.2 to 1.2.9 (through the newest release) - CVE-2016-1181: 1.0.2 to 1.2.9 (through the newest release) - CVE-2015-0899: 1.1 to 1.2.9 (through the newest release) - CVE-2008-2025: 1.0.2 to 1.2.9 (through the newest release) - CVE-2006-1548: 1.0.2 to 1.2.8 (1.2.9 is outside it) - CVE-2006-1547: 1.0.2 to 1.2.8 (1.2.9 is outside it) - CVE-2006-1546: 1.0.2 to 1.2.8 (1.2.9 is outside it) ## Advisories (10) ### [CVE-2025-54656](https://cve.now/CVE-2025-54656): Apache Struts Extras: Improper Output Neutralization for Logs - Severity: Medium 6.5 - Published: Jul 30, 2025 - Affected: versions 1.2.9. - No fix released. The latest release, 1.2.9, is still affected. ### [CVE-2023-49735](https://cve.now/CVE-2023-49735): Apache Tiles: Unvalidated input may lead to path traversal and XXE - Severity: Low - Published: Nov 30, 2023 - Affected: from 1.1, through 1.2.9. - No fix released. The latest release, 1.2.9, is still affected. ### [CVE-2023-34396](https://cve.now/CVE-2023-34396): Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms - Severity: Medium 4.3 - Published: Jun 14, 2023 - Affected: through 1.2.9. - No fix released. The latest release, 1.2.9, is still affected. ### [CVE-2016-1182](https://cve.now/CVE-2016-1182): ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attacke - Severity: Unrated - Published: Jul 4, 2016 - Affected: through 1.2.9. - No fix released. The latest release, 1.2.9, is still affected. ### [CVE-2016-1181](https://cve.now/CVE-2016-1181): ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote atta - Severity: Unrated - Published: Jul 4, 2016 - Affected: through 1.2.9. - No fix released. The latest release, 1.2.9, is still affected. ### [CVE-2015-0899](https://cve.now/CVE-2015-0899): The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions… - Severity: Unrated - Published: Jul 4, 2016 - Affected: from 1.1, through 1.2.9. - No fix released. The latest release, 1.2.9, is still affected. ### [CVE-2008-2025](https://cve.now/CVE-2008-2025): Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on… - Severity: Unrated - Published: Apr 9, 2009 - Affected: fixed in 1.2.9-162.31.1. - No fix released. The advisory names 1.2.9-162.31.1 as the fix, which the registry doesn't have yet. The latest release, 1.2.9, is still affected. ### [CVE-2006-1548](https://cve.now/CVE-2006-1548): Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache… - Severity: Unrated - Published: Mar 30, 2006 - Affected: fixed in 1.2.9. - Fixed in 1.2.9 (released Mar 23, 2006, 7 days before disclosure). - The latest release, 1.2.9, is not affected. ### [CVE-2006-1547](https://cve.now/CVE-2006-1547): ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service v - Severity: High 7.5 · KEV - Published: Mar 30, 2006 - Affected: fixed in 1.2.9. - Fixed in 1.2.9 (released Mar 23, 2006, 7 days before disclosure). - The latest release, 1.2.9, is not affected. ### [CVE-2006-1546](https://cve.now/CVE-2006-1546): Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a… - Severity: Unrated - Published: Mar 30, 2006 - Affected: fixed in 1.2.9. - Fixed in 1.2.9 (released Mar 23, 2006, 7 days before disclosure). - The latest release, 1.2.9, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/struts:struts Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.