CVE-2017-9804: Apache Struts - Custom URL Validation Vulnerability
Summary
CVE-2017-9804: Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.3.7, < 2.3.34
>= 2.5.0, < 2.5.13
Fixed in 2.3.34 or 2.5.13, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture. The struts2-core package is a core component of Apache Struts that handles various functionalities, including form validation. This vulnerability affects versions 2.3.7 to 2.3.33 and 2.5 to 2.5.12 of the struts2-core package. The vulnerability arises when an application allows users to enter a URL in a form field and uses the built-in URLValidator for validation.
Vulnerability Detail
The vulnerability allows an attacker to prepare a specially crafted URL that can overload the server process during the validation of the URL. This vulnerability is a result of an incomplete fix for a previous vulnerability (S2-047 / CVE-2017-7672). By exploiting this vulnerability, an attacker can potentially disrupt the normal functioning of the server or perform other malicious activities.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.3.7, < 2.3.342.3.34 -
>= 2.5.0, < 2.5.132.5.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround is to implement a custom URL validation logic that properly handles the validation of URLs entered by users. This can be done by implementing a custom validator or using a third-party library that provides secure URL validation functionality.
Conclusion
The Apache Struts vulnerability (CVE-2017-9804) allows attackers to overload the server process during URL validation. It is crucial to upgrade to the patched versions or implement a custom URL validation logic to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and follows the MVC (Model-View-Controller) architecture.
Versions 2.3.7 to 2.3.33 and 2.5 to 2.5.12 of the struts2-core package are affected by this vulnerability.
Exploiting this vulnerability can lead to server overload or enable an attacker to perform other malicious activities.
To fix this vulnerability, it is recommended to upgrade the struts2-core package to version 2.3.34 or above for versions 2.3.x, and version 2.5.13 or above for versions 2.5.x.
A temporary workaround is to implement a custom URL validation logic that properly handles the validation of URLs entered by users.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
