Apache Struts
Apache Struts is a free, open-source, MVC framework for creating elegant, modern Java web applications. It favors convention over configuration, is extensible using a plugin architecture, and ships with plugins to support REST, AJAX and JSON.
Download
Technology Primer
Apache Struts 7.3.0 GA
Apache Struts 7.3.0 GA has been released
on 1 August 2026.
Apache Struts 6.11.0 GA
Apache Struts 6.11.0 GA has been released
on 1 August 2026.
End-of-Life Struts Versions
Some Struts versions are no longer supported and receive no further security patches. We recommend migrating to the latest release. If migration is not immediately feasible, see End-of-Life versions for available options.
Security Bulletins S2-070 to S2-074
Upgrade to Apache Struts 7.3.0 or 6.11.0 to mitigate the vulnerabilities.
- S2-070: shared parsing state in the JSON plugin (announcement)
- S2-071: shared serialization state in the JSON plugin (announcement)
- S2-072: unbounded read of a JSON request body (announcement)
- S2-073: unbounded read of a Content Security Policy violation report (announcement)
- S2-074: unbounded growth of localized-text caches (announcement)
Google's Patch Reward program
During SFHTML5 Google announced that they extend their program to cover the Apache Struts project as well. Now you can earn money preparing patches for us! read more
CVE-2025-68493: XXE vulnerability in XWork component
Upgrade to at least Apache Struts 6.1.1 to mitigate the vulnerability.
Read more in the Announcement or in the Security Bulletin S2-069