CVE-2017-9787: Apache Struts - Spring AOP Functionality Vulnerable to DoS Attack
Summary
CVE-2017-9787: Spring AOP functionality (Struts) vulnerable to DoS attack. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.3.7, < 2.3.33
>= 2.5.0, < 2.5.12
Fixed in 2.3.33 or 2.5.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture. The Struts2-core package is a core component of Apache Struts, responsible for handling actions and managing the flow of requests. This vulnerability affects versions 2.3.0 to 2.3.32 and 2.5.0 to 2.5.11 of the Struts2-core package.
Vulnerability Detail
The vulnerability arises from the usage of Spring AOP functionality to secure Struts actions. It allows an attacker to perform a Denial of Service (DoS) attack. By exploiting this vulnerability, an attacker can overload the server by sending a large number of specially crafted requests, causing it to become unresponsive or crash. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.7, < 2.3.332.3.33 -
>= 2.5.0, < 2.5.122.5.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to implement rate limiting or request throttling mechanisms at the network or application level. This can help mitigate the impact of the DoS attack by limiting the number of requests that can be processed within a given time frame.
Conclusion
The vulnerability in Apache Struts' Spring AOP functionality can lead to a DoS attack, potentially causing service disruption. It is crucial to upgrade to the fixed versions (2.5.12 or 2.3.33) of the Struts2-core package to mitigate this vulnerability. If immediate upgrade is not possible, implementing rate limiting or request throttling mechanisms can provide temporary protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC (Model-View-Controller) architectural pattern.
Spring AOP (Aspect-Oriented Programming) is a framework that provides cross-cutting concerns, such as logging, security, and transaction management, to be applied declaratively to the application.
A Denial of Service (DoS) attack is an attempt to make a computer system or network resource unavailable to its intended users by overwhelming it with a flood of malicious requests or by exploiting vulnerabilities to exhaust system resources.
This vulnerability allows an attacker to perform a DoS attack on a server running Apache Struts with the vulnerable Struts2-core package. The server may become unresponsive or crash, resulting in service disruption.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software, using just the pom.xml file.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
