CVE-2016-4465

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.

• CWE-20

• http://jvn.jp/en/jp/JVN12352818/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000114VDB Entry, Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21987854Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• http://www.securityfocus.com/bid/91278
• https://bugzilla.redhat.com/show_bug.cgi?id=1348253Issue Tracking
• https://struts.apache.org/docs/s2-041.htmlVendor Advisory
• http://jvn.jp/en/jp/JVN12352818/index.htmlVendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000114VDB Entry, Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21987854Third Party Advisory
• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• http://www.securityfocus.com/bid/91278
• https://bugzilla.redhat.com/show_bug.cgi?id=1348253Issue Tracking
• https://struts.apache.org/docs/s2-041.htmlVendor Advisory

Published

Jul 4, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4459Stack-based buffer overflow in native/mod_manager/node.c in …
• CVE-2016-4460Apache Pony Mail 0.6c through 0.8b allows remote attackers t…
• CVE-2016-4461Apache Struts 2.x before 2.3.29 allows remote attackers to e…
• CVE-2016-4462By manipulating the URL parameter externalLoginKey, a malici…
• CVE-2016-4463Stack-based buffer overflow in Apache Xerces-C++ before 3.1.…
• CVE-2016-4464The application plugins in Apache CXF Fediz 1.2.x before 1.2…
• CVE-2016-4466Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-4467The C client and C-based client bindings in the Apache Qpid …
• CVE-2016-4468SQL injection vulnerability in Pivotal Cloud Foundry (PCF) b…
• CVE-2016-4469Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2016-4470The key_reject_and_link function in security/keys/key.c in t…
• CVE-2016-4471ManageIQ in CloudForms before 4.1 allows remote authenticate…