---
id: "CVE-2017-9805"
kind: "vulnerability"
aliases: ["CVE-2017-9805"]
title: "Apache Struts: Apache Struts Deserialization of Untrusted Data Vulnerability"
severity: "critical"
cvss: 8.1
epss: 0.99396
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Struts", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-struts", "exploited", "java", "package", "rest-plugin", "struts"]
not_affected_if: ["no-rest-plugin", "non-java"]
published_at: "2017-09-15T19:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-9805", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-9805", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9805", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Apache Struts: Apache Struts Deserialization of Untrusted Data Vulnerability

Apache Struts' REST Plugin deserializes XML with XStream without type filtering, so a crafted XML request can trigger deserialization of attacker-chosen objects. An unauthenticated remote attacker can run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Struts affected ? fixed ?

## How to check

Check whether the struts2-rest-plugin jar is in the app's WEB-INF/lib or dependency tree and whether the app uses REST/XML handling.

## Fix

Upgrade Apache Struts to a fixed release per the vendor advisory, or remove the REST plugin if unused.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-9805
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-9805
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-9805

## From the sources

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_