Apache Struts Release Notes

Bug Fixes

This release patches the following:

• Apache Struts 2 is Missing XML Validation (CVE-2025-68493)
  • org.apache.struts:struts2-core:2.5.33-struts2-2.5.39

Bug Fixes

This release patches the following:

• Vulnerable to DoS via File Leak (CVE-2025-64775 and CVE-2025-66675).
  • org.apache.struts:struts2-core:2.5.33-struts2-2.5.38

Dependency Upgrades

• commons-fileupload:commons-fileupload 1.4 -> 1.6.0
  • CVE-2023-24998 FileUpload denial of service vulnerability
    • Added configuration: struts.multipart.maxFiles (default 256) - The maximum number of files allowed in a multipart request
    • Added configuration: struts.multipart.maxFileSize (default 2097152) - The maximum size per file in a multipart request
  • CVE-2025-48976 FileUpload DoS via part headers
    • Added configuration: struts.multipart.partHeaderSizeMax (default 512) - The maximum size of headers per part in a multipart request in bytes
• commons-io:commons-io 2.6 -> 2.19.0
  • CVE-2021-29425 Path Traversal and Improper Input Validation in Apache Commons IO
  • CVE-2024-47554 Possible denial of service attack on untrusted input to XmlStreamReader
• commons-beanutils:commons-beanutils 1.9.4 -> 1.11.0
  • CVE-2025-48734 Improper Access Control vulnerability

Bug Fixes

This release patches the following:

• CVE-2008-2025: Possible XSS
  • This is not a security flaw in Struts. Struts has never guaranteed to perform filtering of the untrusted user inputs used as html tag attributes names or values.
  • A patch was applied to escape untrusted user inputs using double quotes if not already escaped.
• CVE-2014-0114: Class Loader manipulation
• CVE-2015-0899: MultiPageValidator bypass
• CVE-2016-1181: Multithreaded access to an ActionForm multipart access
• CVE-2016-1182: Access to Validator configuration
• CVE-2023-34396: Struts upload memory exhaustion
  • struts-config controller tag supports maxStringLen with default of 4K
• CVE-2023-49735: Tiles: Unvalidated input may lead to SSRF/XXE
• CVE-2025-54656: Improper Output Neutralization for Logs Vulnerability

Dependency Upgrades

• commons-beanutils:commons-beanutils 1.6.1 -> 1.9.4
  • CVE-2014-0114
  • CVE-2019-10086
• commons-collections:commons-collections 3.1 -> 3.2.2
  • CVE-2015-7501
  • CVE-2015-6420
• commons-digester:commons-digester 1.6 -> 1.8
• commons-fileupload:commons-fileupload 1.0 -> nes-v1.5.2
  • CVE-2013-0248
  • CVE-2013-2186
  • CVE-2014-0050
  • CVE-2016-1000031
  • CVE-2016-3092
  • CVE-2023-24998 commons-fileupload: limit number of request parts
    • struts-config controller tag supports:
      • fileCountMax Sets the maximum number of file parts with default of -1
      • maxSize Sets the maximum allowed size of a complete request with default of 256M
• commons-logging:commons-logging 1.0 -> 1.3.5
  • log4j 1.1.3 -> log4j2 2.24.3
    • CVE-2019-17571
    • CVE-2021-4104
    • CVE-2022-23302
    • CVE-2022-23305
    • CVE-2022-23307
• oro:oro 2.0.7 -> 2.0.8
• taglibs:standard 1.0.6 -> nes-v1.0.7
  • CVE-2015-0254

Notes

• This release originates from the open‑source Struts project forked by HeroDevs.
• groupId: struts
• artifactId: struts, struts-el

Bug Fixes

This release patches the following:

• CVE-2025-54656: Improper Output Neutralization for Logs Vulnerability

Bug Fixes

This release patches the following:

• CVE-2025-48976: FileUpload DoS via part headers
  • Controller supports tag maxHeaderSize to limit the size of part headers with default of 256 bytes.
• CVE-2025-48734: Improper Access Control vulnerability
  • Dependency upgrade of beanutils to 1.11.0 or override to nes-v1.7.4 addresses this vulnerability.

Dependency Upgrades

• commons-beanutils:commons-beanutils 1.9.4 -> 1.11.0
• commons-fileupload:commons-fileupload 1.5 -> nes-v1.5.2

Bug Fixes

This release patches the following:

• CVE-2025-48976 FileUpload DoS via part headers
  • Controller supports tag maxHeaderSize to limit the size of part headers with default of 256 bytes.
• CVE-2025-48734: Improper Access Control vulnerability
  • Dependency upgrade of beanutils to 1.11.0 or override to nes-v1.7.4 addresses this vulnerability.

Dependency Upgrades

• commons-fileupload:commons-fileupload nes-v1.5.1 -> nes-v1.5.2
• commons-beanutils:commons-beanutils 1.9.4 -> 1.11.0
• remove commons-lang:commons-lang 2.1
  • Struts 1.1.x does not use commons-lang, so it is removed to avoid confusion.
  • If your application uses commons-lang, please add as a dependency to your project.
  • Recommended version is org.apache.commons:commons-lang3:3.18.0.

Bug Fixes

This release patches the following:

• CVE-2005-3745: Cross-site scripting (XSS)

Bug Fixes

This release patches the following:

• CVE-2006-1546: Improper Input Validation
  • Breaking Change instructions
• CVE-2006-1547: DoS Multipart
• CVE-2006-1548: Cross-site scripting (XSS)
• CVE-2008-2025: Possible XSS
  • This is not a security flaw in Struts. Struts has never guaranteed to perform filtering of the untrusted user inputs used as html tag attributes names or values.
  • A patch was applied to escape untrusted user inputs using double quotes if not already escaped.
• CVE-2014-0114: Class Loader manipulation
• CVE-2015-0899: MultiPageValidator bypass
• CVE-2016-1181: Multithreaded access to an ActionForm multipart access
• CVE-2016-1182: Access to Validator configuration
• CVE-2023-34396: Struts upload memory exhaustion
  • struts-config controller tag supports maxStringLen with default of 4K
• CVE-2023-49735: Tiles: Unvalidated input may lead to SSRF/XXE

Dependency Upgrades

• commons-beanutils:commons-beanutils 1.6.1 -> 1.9.4
  • CVE-2014-0114
  • CVE-2019-10086
• commons-collections:commons-collections 3.1 -> 3.2.2
  • CVE-2015-7501
  • CVE-2015-6420
• commons-digester:commons-digester 1.6 -> 1.8
• commons-fileupload:commons-fileupload 1.0 -> nes-v1.5.1
  • CVE-2013-0248
  • CVE-2013-2186
  • CVE-2014-0050
  • CVE-2016-1000031
  • CVE-2016-3092
  • CVE-2023-24998 commons-fileupload: limit number of request parts
    • struts-config controller tag supports:
      • fileCountMax Sets the maximum number of file parts with default of -1
      • maxSize Sets the maximum allowed size of a complete request with default of 256M
• commons-logging:commons-logging 1.0 -> 1.3.5
  • log4j 1.1.3 -> log4j2 2.24.3
    • CVE-2019-17571
    • CVE-2021-4104
    • CVE-2022-23302
    • CVE-2022-23305
    • CVE-2022-23307
• oro:oro 2.0.7 -> 2.0.8
• taglibs:standard 1.0.6 -> nes-v1.0.7
  • CVE-2015-0254

Notes

• This release originates from the open‑source Struts project forked by HeroDevs.
• groupId: struts
• artifactId: struts, struts-legacy, struts-el

Bug Fixes

This release patches the following:

• CVE-2023-34396 Struts upload memory exhaustion
  • struts-config controller tag supports maxStringLen with default of 4K
• CVE-2023-24998 commons-fileupload: limit number of request parts
  • struts-config controller tag supports:
    • fileCountMax Sets the maximum number of file parts with default of -1
    • maxSize Sets the maximum allowed size of a complete request with default of 256M
• CVE-2023-49735 Tiles: Unvalidated input may lead to SSRF/XXE

Bug Fixes

This release patches the following:

• CVE-2012-1007: Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10.
• CVE-2014-0114: Class Loader manipulation.
• CVE-2015-0899: MultiPageValidator bypass in Apache Struts 1.
• CVE-2016-1181: Multithreaded access to an ActionForm multipart access.
• CVE-2016-1182: Access to Validator configuration.

Bug Fixes

This release patches the following:

• File upload logic is flawed, and allows an attacker to enable paths with traversals (CVE-2024-53677).
  • com.herodevs.nes.apache.struts.struts2-core:2.5.33-struts2-2.5.35