Apache Struts vulnerable to possible DoS attack when using URLValidator

MITTEL 5.9CVE-2016-8738 · GHSA-86vq-8qhc-5rqw · Published 20/09/2017 · updated 17/06/2026

Kurz gesagt

CVE-2016-8738 ist eine Schwachstelle (MITTEL (CVSS 5.9)) in org.apache.struts:struts2-core, struts (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.3%, höher als bei 88.4% aller Schwachstellen.
Abhilfe: auf 2.5.13 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.struts:struts2-core Maven	`≥ 2.5.0, < 2.5.13`	`2.5.13`
struts apache	`= 2.5= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5`	No fix yet

Description

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

NVD description

In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.

References

nvd.nist.gov/vuln/detail/CVE-2016-8738 · ADVISORY
apache/struts commit 554b9dd · WEB
apache/struts · PACKAGE
security.netapp.com/advisory/ntap-20180629-0003 · WEB
struts.apache.org/docs/s2-044.html · WEB
securityfocus.com/bid/94657 · Third Party Advisory
security.netapp.com/advisory/ntap-20180629-0003

Weitere Schwachstellen in org.apache.struts:struts2-core

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.struts:struts2-core

Maven

≥ 2.5.0, < 2.5.13

2.5.13

struts

apache

= 2.5= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5

No fix yet

Description

NVD description

Weitere Schwachstellen in org.apache.struts:struts2-core

Alle anzeigen →