Apache Struts

Apache Struts is tracked by BlackTree as a software framework or development platform. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.

Lifecycle status

No support or retirement date is shown unless BlackTree can link it to a registered publisher source. A missing date means that a boundary is not publicly stated, has not yet been extracted, or still needs source routing. It does not mean the product is supported indefinitely.

Product overview

Main capabilities

Application development components
Versioned runtime or build interfaces
Security and compatibility maintenance

Typical use

Used by software teams to build, run or maintain applications.

Deployment

Included in source projects, application dependencies, build systems or managed runtimes.

Lifecycle records

No verified lifecycle boundary is currently published for this product family.

Official sources

MANUAL

Apache Struts official lifecycle source

Registered for manual verification because unattended extraction is unavailable or inappropriate.

Open publisher source

Package vulnerability advisories

CVE-2012-0391

Apache Struts Remote Java Code Execution

Fixed: 2.2.3.1

CVE-2013-2251

Code injection in Apache Struts

Fixed: 2.3.15.1

CVE-2020-17530

Remote code execution in Apache Struts

Fixed: 2.5.26

CVE-2025-68493

Apache Struts 2 is Missing XML Validation

Fixed: 6.1.1

CVE-2025-66675

Apache Struts has a Denial of Service vulnerability

Fixed: 6.8.0, 7.1.1

CVE-2025-64775

Apache Struts is Vulnerable to DoS via File Leak

Fixed: 6.8.0, 7.1.1

CVE-2023-41835

Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability

Fixed: 6.3.0.1, 6.1.2.2, 2.5.32

CVE-2018-11776

Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

Fixed: 2.3.35, 2.5.17