CVE-2016-4436: Apache Struts improper action name cleanup
Summary
CVE-2016-4436: Apache Struts improper action name cleanup. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.0.0, < 2.3.29
>= 2.5-BETA1, < 2.5.1
Fixed in 2.3.29 or 2.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The 'org.apache.struts:struts2-core' package is a core component of Apache Struts that handles the processing of actions and requests. This vulnerability affects versions before 2.3.29 and 2.5.x before 2.5.1 of the 'org.apache.struts:struts2-core' package.
Vulnerability Detail
The vulnerability, identified as CVE-2016-4436, allows attackers to exploit improper action name cleanup in Apache Struts. By manipulating action names, attackers can execute arbitrary code or perform unauthorized actions on the affected system. The exact impact of this vulnerability is unspecified, but it can lead to severe consequences such as data breaches, remote code execution, or privilege escalation.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.292.3.29 -
>= 2.5-BETA1, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the 'org.apache.struts:struts2-core' package to the appropriate version.
Conclusion
The CVE-2016-4436 vulnerability in Apache Struts' improper action name cleanup can have severe consequences, including data breaches and remote code execution. It is crucial to upgrade the 'org.apache.struts:struts2-core' package to the recommended versions to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
The impact of this vulnerability is unspecified, but it can lead to severe consequences such as data breaches, remote code execution, or privilege escalation.
Versions before 2.3.29 and 2.5.x before 2.5.1 of the 'org.apache.struts:struts2-core' package are affected.
To fix this vulnerability, upgrade the 'org.apache.struts:struts2-core' package to version 2.3.29 or later if using versions before 2.3.29. For versions 2.5.x, upgrade to version 2.5.1 or later.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the 'org.apache.struts:struts2-core' package.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
