CVE-2017-5638: RCE in Apache Struts 2

Critical RCE in Struts 2 via HTTP header. CVSS 9.8. Versions 2.3.x < 2.3.32 and 2.5.x < 2.5.10.1.

CVE-2017-5638 is a remote code execution (RCE) vulnerability in the multipart parser of Apache Struts 2. The flaw affects versions 2.3.x < 2.3.32 and 2.5.x < 2.5.10.1. An attacker can exploit it by sending crafted HTTP headers (Content-Type, Content-Disposition, Content-Length) during file uploads. This enables arbitrary command execution on the server with the privileges of the web application.

CVSS 9.8 (critical). The vulnerability was discovered and actively exploited in March 2017. Official patches are available from Apache. GitHub repositories declare they contain exploits; signals of interest persist in 2026. Many legacy systems remain vulnerable and represent tangible risk to organizations still depending on unpatched versions.

Immediately inventory all systems running Struts 2 and verify version. Apply patches to 2.3.32+ or 2.5.10.1+ without delay. For legacy systems not upgradeable: isolate from public networks, deploy WAF to filter anomalous HTTP headers during uploads, monitor access logs for suspicious requests. Conduct post-patching reviews to rule out prior compromise.

At a glance

What: CVE-2017-5638 is a remote code execution vulnerability in the multipart parser of Apache Struts 2. It affects versions 2.3.x < 2.3.32 and 2.5.x < 2.5.10.1. A remote attacker can exploit it by sending crafted HTTP headers (Content-Type, Content-Disposition, Content-Length) during file uploads, enabling arbitrary command execution on the server.
Severity: CVSS 9.8 (critical). Discovered and actively exploited in March 2017. Official patches available from Apache. GitHub repositories declare they contain exploits; signals of interest persist in 2026. Many legacy systems remain vulnerable.
Affected versions: Apache Struts 2 versions 2.3.x before 2.3.32 and versions 2.5.x before 2.5.10.1.
Fix: Update to Struts 2.3.32 or later for the 2.3 branch, or to 2.5.10.1 or later for the 2.5 branch.
Status: Official patches available since November 2017. Vulnerability is public. Signals on GitHub repositories present as of November 2026 indicate continued interest and persistence of accessible attack code.
Action: Inventory Struts 2 systems and verify version. Apply patches to 2.3.32+ or 2.5.10.1+ immediately. For legacy systems not upgradeable: isolate from public networks and deploy WAF to filter anomalous HTTP headers during uploads. Monitor access logs for suspicious requests. Conduct post-patching reviews.

Sources: NVD, CVE-2017-5638

← All articles