CVE-2016-3093: Improper Input Validation in Apache Struts
Summary
CVE-2016-3093: Denial of service in Apache Struts. Affects org.apache.struts:struts2-core versions >= 2.0.0, < 2.3.24.3. Fixed in 2.3.24.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Struts is a popular open-source framework for developing Java web applications. It provides a set of reusable components and a MVC (Model-View-Controller) architecture for building scalable and maintainable web applications. The vulnerability identified as CVE-2016-3093 affects Apache Struts versions 2.0.0 through 2.3.24.1 when used with OGNL before version 3.0.12. OGNL (Object-Graph Navigation Language) is a powerful expression language used in Apache Struts for evaluating expressions and accessing object properties. This vulnerability arises due to improper caching of method references, which can be exploited by remote attackers to cause a denial of service (block access to a web site) through unspecified vectors.
Vulnerability Detail
The vulnerability in Apache Struts allows remote attackers to disrupt the normal functioning of a web site by exploiting the improper caching of method references. By leveraging this vulnerability, an attacker can send specially crafted requests to the targeted web application, causing it to consume excessive resources and become unresponsive. This can lead to a denial of service (DoS) condition, preventing legitimate users from accessing the web site. The impact of this vulnerability can range from temporary service disruption to prolonged downtime, depending on the severity of the attack and the resources available to the targeted system.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.24.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Apache Struts is not immediately feasible, a temporary workaround can be implemented to mitigate the risk. One possible workaround is to implement rate limiting or request throttling mechanisms at the network or application layer to limit the impact of potential DoS attacks. This can help mitigate the risk of resource exhaustion and maintain the availability of the web application. However, it is important to note that workarounds may only provide temporary relief and should not be considered a long-term solution. Upgrading to a patched version of Apache Struts is still the recommended approach.
Conclusion
The vulnerability identified as CVE-2016-3093 in Apache Struts can be exploited by remote attackers to cause a denial of service (DoS) by exploiting the improper caching of method references. To mitigate this vulnerability, it is crucial to upgrade Apache Struts to version 2.3.24.3 or later. Regularly checking for security updates and promptly applying them is essential to ensure the continued security of the web application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a set of reusable components and a MVC architecture for building scalable and maintainable web applications.
OGNL (Object-Graph Navigation Language) is an expression language used in Apache Struts for evaluating expressions and accessing object properties.
The vulnerability allows remote attackers to cause a denial of service (DoS) by exploiting the improper caching of method references in Apache Struts. This can lead to temporary or prolonged downtime of the targeted web application.
To fix this vulnerability, it is recommended to upgrade Apache Struts to version 2.3.24.3 or later. Regularly checking for security updates and applying them promptly is also advisable.
A temporary workaround is to implement rate limiting or request throttling mechanisms to mitigate the risk of DoS attacks. However, upgrading to a patched version of Apache Struts is still the recommended approach.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
