Disclosure summary
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
CISA remediation guidance
Apply updates per vendor instructions.
Original records & references
PUBLISHED 2021-11-03T00:00:00-04:00
MODIFIED 2021-11-03T00:00:00-04:00
INGESTED 2026-10-06T11:42:59-04:00