VYPR
High severity8.1CISA KEVNVD Advisory· Published Sep 15, 2017· Updated Apr 21, 2026

CVE-2017-9805

CVE-2017-9805

Description

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts2-rest-pluginMaven
>= 2.1.1, < 2.3.342.3.34
org.apache.struts:struts2-rest-pluginMaven
>= 2.5.0, < 2.5.132.5.13

Affected products

11

Patches

4

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

21

News mentions

0

No linked articles in our index yet.