8.1
High
Exploited
CVE-2017-9805 Apache Struts Deserialization of Untrusted Data Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-502
Description
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Struts | Versions not published |
References
- www.oracle.com www.oracle.com
- struts.apache.org struts.apache.org
- 1039263 www.securitytracker.com
- 100609 www.securityfocus.com
- 20170907 Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017 tools.cisco.com
- bugzilla.redhat.com bugzilla.redhat.com
- blogs.apache.org blogs.apache.org
- 42627 www.exploit-db.com
- lgtm.com lgtm.com
- cwiki.apache.org cwiki.apache.org
- security.netapp.com security.netapp.com
- VU#112992 www.kb.cert.org
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Apache Struts
The 33 CVEs of Apache Struts →
CVE-2026-104714
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache…
Not rated
CVE-2026-104713
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Not rated
CVE-2026-104712
Asymmetric resource consumption (amplification) vulnerability in Apache Struts
Not rated
CVE-2026-104711
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection')…
Not rated