Servers and applications
CVE-2016-3093 Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
Severity Medium 5.3
Published 7 Jun 2016
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 8.4% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · No login needed · No user action needed
Attacker can Slow it down
CVSS vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Sources NVD Affected software Software Affected versions Apache StrutsServers and applications · cpe:a:apache:struts Version 2.3.24.1 Version 2.3.24 Version 2.3.20.3 Version 2.3.20.1 All 55 release lines Version 2.0.0 Version 2.0.1 Version 2.0.2 Version 2.0.3 Version 2.0.4 Version 2.0.5 Version 2.0.6 Version 2.0.7 Version 2.0.8 Version 2.0.9 Version 2.0.10 Version 2.0.11 Version 2.0.11.1 Version 2.0.11.2 Version 2.0.12 Version 2.0.13 Version 2.0.14 Version 2.1.0 Version 2.1.1 Version 2.1.2 Version 2.1.3 Version 2.1.4 Version 2.1.5 Version 2.1.6 Version 2.1.8 Version 2.1.8.1 Version 2.2.1 Version 2.2.1.1 Version 2.2.3 Version 2.2.3.1 Version 2.3.1 Version 2.3.1.1 Version 2.3.1.2 Version 2.3.4 Version 2.3.4.1 Version 2.3.7 Version 2.3.8 Version 2.3.12 Version 2.3.14 Version 2.3.14.1 Version 2.3.14.2 Version 2.3.14.3 Version 2.3.15 Version 2.3.15.1 Version 2.3.15.2 Version 2.3.15.3 Version 2.3.16 Version 2.3.16.1 Version 2.3.16.2 Version 2.3.16.3 Version 2.3.20 Version 2.3.20.1 Version 2.3.20.3 Version 2.3.24 Version 2.3.24.1
References NVD https://nvd.nist.gov/vuln/detail/CVE-2016-3093 CVE.org https://www.cve.org/CVERecord?id=CVE-2016-3093