CVE-2016-8738: In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-i...

Security readout for executives and security teams

This vulnerability can let a crafted URL value consume excessive server resources during Apache Struts URL validation. It matters where a Struts application accepts URL input from users and uses the built-in URLValidator. The source bundle does not provide a CVSS score or confirmed exploitation evidence. Exposure is likely limited to applications running Apache Struts 2.5 through 2.5.5 that accept user-entered URLs and validate them with the built-in URLValidator. Treat this as a targeted denial-of-service risk for affected Struts applications, especially public-facing systems. Prioritize discovery and vendor-guided remediation, but avoid assuming broad enterprise exposure without confirming vulnerable versions and URLValidator use. Mitigation focus: Inventory Apache Struts applications and identify versions 2.5 through 2.5.5.; Find forms or API paths accepting user-supplied URL values.; Confirm whether built-in URLValidator is used for those inputs..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.