| CVE ID | CVE-2017-5638 |
| Affected software | Apache Struts 2, versions 2.3.5 through 2.3.31 and 2.5 through 2.5.10 |
| Severity | CVSS 10.0 (Critical) — unauthenticated remote code execution |
| Fixed in | Struts 2.3.32 / 2.5.10.1 |
| Disclosed | March 7, 2017 |
What Happened
Apache Struts is a popular Java framework for building web applications. Its file-upload component (Jakarta Multipart parser) read the Content-Type header from incoming requests, and under certain error conditions it would evaluate part of that header as an OGNL expression — effectively letting it run as code on the server. An attacker only had to send a single crafted HTTP request with a malformed header.
What This Means
This is an injection vulnerability: untrusted input (an HTTP header) was passed somewhere it could be interpreted and executed rather than treated as plain text, leading directly to remote code execution — no authentication, no user interaction.
Why You Should Care
The Apache Struts team released a patched version on the same day the vulnerability was disclosed. Equifax was breached starting in May 2017 — more than two months later — because the patch had not yet been applied to a public-facing dispute-portal server. The breach exposed Social Security numbers, birth dates, and addresses for roughly 148 million people, and remains one of the most cited examples of a known, patched vulnerability causing a major breach purely through delayed patching.
What You Can Do
- Maintain an inventory of every framework and library in production so you know immediately when a CVE affects you.
- Apply critical security patches on an expedited timeline, separate from normal release cycles — "patch on the next quarterly release" is too slow for critical RCEs.
- Run automated vulnerability scanning against internet-facing applications to catch unpatched, known-vulnerable components.
- Have an incident-response and breach-notification plan ready before you need it — Equifax's delayed and confused public response compounded the damage.
The Equifax breach led to a $700 million settlement with the FTC and U.S. states, congressional hearings, and the resignation of Equifax's CEO — all traceable back to a single unpatched Struts server.
A patch existed for months before attackers exploited this exact hole to pull off one of the largest consumer data breaches in history — proof that patching speed matters as much as patching at all.
Explore More CVEs