Apache Struts2 JSON plugin insecure deserialization report continues
Daniel Owens cites earlier Struts2 JSON denial-of-service write-ups and a naïve proof-of-concept script; this excerpt ends before new details.
Stories per day · 30 days
1 RSS
Relatedcisa3denial-of-service3kev3command-injection2cve-2026-1047112java2ognl2rce2rest2actively-exploited1bigdecimal1china1cve-2016-30811cve-2026-1047121cve-2026-1047131cve-2026-1047141dark-web1data-leak1
7 stories, newest first · one card per story
Stories tagged #apache-struts
CISA Adds Actively Exploited Apache Struts Command Injection Flaw to KEV Catalog
CISA added actively exploited Apache Struts command-injection flaw CVE-2016-3081 to the KEV catalog.
CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
CISA added exploited Apache Struts command injection flaw CVE-2016-3081 to its KEV catalog with forensic triage required.
8
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
Apache Struts Vulnerabilities Enable Remote Code Execution, DoS and Data Disclosure
Four Apache Struts flaws can enable remote code execution, denial of service, or cross-user data disclosure.
6
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin
Apache Struts REST plugin reads request bodies without a size limit, enabling memory-exhaustion denial of service.
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale
SOCRadar flagged alleged French leaks, an SMTP dump, a US access auction, and a Struts exploit sale.