CVE-2016-8738: Input Validation
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Other sources
In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
— NVD
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8738?
CVE-2016-8738 has a high severity rating due to its potential for denial of service attacks.
How do I fix CVE-2016-8738?
To fix CVE-2016-8738, upgrade to Apache Struts version 2.5.13 or later.
What versions are affected by CVE-2016-8738?
CVE-2016-8738 affects Apache Struts versions 2.5.0 to 2.5.5.
What type of attack does CVE-2016-8738 enable?
CVE-2016-8738 enables denial of service attacks through specially crafted URLs.
Is CVE-2016-8738 exploitable in all configurations of Apache Struts?
CVE-2016-8738 is exploitable in configurations where user input is directly fed into the URL validation process.