How many CVEs have a located fix in apache/struts?

40 published CVEs have a fix traced to functions in apache/struts, touching 113 functions across 69 files.

Which function in apache/struts has been patched by the most CVEs?

execute in core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java has been changed by 5 CVE fixes, from 2013 to 2016.

How large is a typical CVE fix in apache/struts?

The median fix changes 45 lines. 28% of fixes change 20 lines or fewer, and 13% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

template

#105 of 500 repositories

apache/struts

Name: apache/struts: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix December 10, 2025

40

CVE fixes located

Published CVEs

113

Functions patched

Distinct function sites

69

Files patched

Distinct source files

2009–2025

Years covered

By CVE publication date

Overview

40 published CVEs have a fix traced to functions in apache/struts, the earliest published in 2009. Those fixes changed 113 distinct functions across 69 files, in 358 patch hunks.

Among the 500 repositories tracked here, apache/struts ranks #105 by the number of CVEs with a located fix.

Most patched functions

Functions in apache/struts changed by the most CVE fixes.

Most patched files

Files in apache/struts changed by the most CVE fixes.

1core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java8 CVEs · 7 functions
2core/src/main/java/org/apache/struts2/StrutsConstants.java7 CVEs · 1 functions
3core/src/main/java/org/apache/struts2/dispatcher/multipart/JakartaMultiPartRequest.java5 CVEs · 13 functions
4xwork-core/src/main/java/com/opensymphony/xwork2/interceptor/ParametersInterceptor.java4 CVEs · 7 functions
5core/src/main/java/org/apache/struts2/interceptor/CookieInterceptor.java4 CVEs · 5 functions
6xwork-core/src/main/java/com/opensymphony/xwork2/ognl/OgnlUtil.java2 CVEs · 5 functions
7xwork-core/src/main/java/com/opensymphony/xwork2/validator/validators/RepopulateConversionErrorFieldValidatorSupport.java2 CVEs · 4 functions
8core/src/main/java/org/apache/struts2/config/entities/ConstantConfig.java2 CVEs · 3 functions
9core/src/main/java/org/apache/struts2/interceptor/FileUploadInterceptor.java2 CVEs · 3 functions
10core/src/main/java/org/apache/struts2/views/util/DefaultUrlHelper.java2 CVEs · 3 functions

Fix size

How much code a CVE fix in apache/struts changes, with backports counted once.

45

Median lines changed

Added plus removed, per CVE

28%

Fixes of 20 lines or fewer

Share of CVE fixes

13%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in apache/struts, and the functions each fix changed.

Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
CVE-2025-66675cleanUp getFile JakartaMultiPartRequest
High · CVSS 8.2
EPSS 0.6%2025-12-10
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
CVE-2024-53677setUpload putCaseInsensitive build
Critical · CVSS 9.5
EPSS 70.1%2024-12-11
Apache Struts: File upload component had a directory traversal vulnerability
CVE-2023-50164contains toMap get
Critical · CVSS 9.8
EPSS 80.8%2023-12-07
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
CVE-2023-41835processNormalFormField getParameterValues getInputStream
High · CVSS 7.5
EPSS 7.3%2023-12-05
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
CVE-2023-34396processNormalFormField getMultipartMaxStringLength AbstractMultiPartRequest
High · CVSS 7.5
EPSS 5.5%2023-06-14
Apache Struts vulnerable to memory exhaustion
CVE-2023-34149processNormalFormField getMultipartMaxStringLength AbstractMultiPartRequest
Medium · CVSS 6.5
EPSS 5.4%2023-06-14
Apache Struts REST Plugin can potentially allow a DoS attack
CVE-2018-1327
High · CVSS 7.5
EPSS 8.6%2018-03-27
Apache Struts vulnerable to possible DoS attack when using URLValidator
CVE-2016-8738validate
Medium · CVSS 5.9
EPSS 3.3%2017-09-20
Path Traversal in Apache Struts
CVE-2016-6795findResult
Critical · CVSS 9.8
EPSS 8.2%2017-09-20
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
CISA KEV
CVE-2017-5638buildErrorMessage intercept
Critical · CVSS 10.0
EPSS 100.0%2017-03-11
Apache Struts improper action name cleanup
CVE-2016-4436cleanupActionName
Critical · CVSS 9.8
EPSS 6.6%2016-10-03
Apache Struts vulnerable to possible DoS attack when using URLValidator
CVE-2016-4465getUrlRegex
Medium · CVSS 5.3
EPSS 10.4%2016-07-04

Get an alert for each new apache/struts CVE, with the patched functions and AI-written analysis.

Monitor struts CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Exiv2/exiv240 CVEs ikus060/rdiffweb40 CVEs livehelperchat/livehelperchat40 CVEs traefik/traefik40 CVEs radare/radare241 CVEs zitadel/zitadel41 CVEs Combodo/iTop39 CVEs debian/xorg-server39 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in apache/struts.

How many CVEs have a located fix in apache/struts?: 40 published CVEs have a fix traced to functions in apache/struts, touching 113 functions across 69 files.
Which function in apache/struts has been patched by the most CVEs?: execute in core/src/main/java/org/apache/struts2/dispatcher/mapper/DefaultActionMapper.java has been changed by 5 CVE fixes, from 2013 to 2016.
How large is a typical CVE fix in apache/struts?: The median fix changes 45 lines. 28% of fixes change 20 lines or fewer, and 13% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track apache/struts CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing