Denial of service in Apache Struts

published 2012-09-05 14 y ago modified 2026-06-16 4 mo ago also GHSA-hrgc-54mv-58gv , EUVD-2022-4209

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 8.1%; EPSS 8.1% chance of exploitation in 30 days, percentile 94%
public exploits: 0; none known

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.

Patch / fix

fixed in 1 links 3

maven org.apache.struts.xwork:xwork-core 2.3.4.1

github.com/apache/struts@80e0318 commit
github.com/apache/struts@87935af commit
struts.apache.org/2.x/docs/s2-011.html advisory

Exploit prediction

8.14% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.struts.xwork:xwork-core	>=2.0.0, <2.3.4.1	2.3.4.1

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

struts.apache.org /2.x/docs/s2-011.html
web, patch, vendor-advisory
github.com /apache/struts/commit/80e03182d66d9e6ab18f9a9a9b3c42725a1c89e9
web
github.com /apache/struts/commit/87935af56a27235e9399308ee1fcfb74f8edcefa
web
secunia.com /advisories/50420
third-party-advisory, vendor-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/78183
vdb-entry, web
openwall.com /lists/oss-security/2012/09/01/5
mailing-list, web
securityfocus.com /bid/55346
vdb-entry
issues.apache.org /jira/browse/WW-3860
web
openwall.com /lists/oss-security/2012/09/01/4
mailing-list, web
nvd.nist.gov /vuln/detail/CVE-2012-4387
advisory
github.com /apache/struts
package

Sources

CVE List CVE-2012-4387
GitHub Advisory GHSA-hrgc-54mv-58gv
NVD CVE-2012-4387

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary