CVE-2017-9793: Apache Struts 2.3.7 - 2.3.33 and 2.5 - 2.5.12: Outdated XStream Library DoS Vulnerability
Summary
CVE-2017-9793: The REST Plugin in Apache Struts is using an outdated XStream library. Affects org.apache.struts:struts2-rest-plugin across 2 version ranges.
< 2.3.34
>= 2.5.0, < 2.5.13
Fixed in 2.3.34 or 2.5.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. The REST Plugin in Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12 utilizes an outdated XStream library. XStream is a Java library used for serializing and deserializing objects to and from XML. This vulnerability allows an attacker to perform a Denial of Service (DoS) attack by sending a specially crafted XML payload in a malicious request.
Vulnerability Detail
The vulnerability arises from the use of an outdated XStream library in the REST Plugin of Apache Struts. By exploiting this vulnerability, an attacker can send a specially crafted XML payload that triggers a DoS attack. This can lead to the unavailability of the affected application, causing disruption to its normal functionality. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.342.3.34 -
>= 2.5.0, < 2.5.132.5.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or block the affected REST Plugin in Apache Struts. This can be achieved by modifying the application's configuration or by implementing network-level controls to filter out requests targeting the vulnerable plugin.
Conclusion
The vulnerability in the REST Plugin of Apache Struts, caused by the use of an outdated XStream library, can be mitigated by upgrading to the latest version of Apache Struts. Alternatively, disabling or blocking the affected plugin can serve as a temporary workaround. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-rest-plugin →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of tools and libraries that simplify the development process and promote code reusability.
The REST Plugin in Apache Struts is an extension that allows developers to build RESTful web services using the Struts framework. It provides support for handling HTTP requests and responses in a RESTful manner.
XStream is a Java library used for serializing and deserializing objects to and from XML. It provides a simple API for converting Java objects to XML and vice versa.
A Denial of Service (DoS) attack is a type of cyber attack where an attacker overwhelms a target system or network with a flood of malicious requests, causing it to become unresponsive or unavailable to legitimate users.
The CVSS score of this vulnerability is 7.5, indicating a high severity level. CVSS (Common Vulnerability Scoring System) is a standardized system for assessing the severity of security vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-rest-plugin.
