CVE-2016-3093: Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3...

Security readout for executives and security teams

This issue can let a remote attacker make some Apache Struts web applications unavailable. The public record describes denial of service, not data theft or code execution. Business urgency depends on whether internet-facing applications still run Struts 2.0.0 through 2.3.24.1 with OGNL before 3.0.12. Exposure is most likely in legacy Java web applications using affected Struts 2 releases and older OGNL. Internet-facing Struts applications carry higher operational risk because the described impact is site availability loss. Treat this as a legacy exposure cleanup item with operational availability impact. It is not presented as code execution, but affected public sites should be addressed promptly because successful abuse could block customer access. Mitigation focus: Inventory Struts and OGNL versions in all Java web applications.; Prioritize internet-facing applications running Struts 2.0.0 through 2.3.24.1.; Follow Apache Struts S2-034 and vendor-specific guidance for upgrades or mitigations..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.