Apache Struts 2.x — End of Life
EOLApache Struts 2.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 2.5 | May 5, 2016 | — | Apr 30, 2024 | 2.5.33 | EOL | |
| 2.3 | Dec 8, 2011 | — | May 14, 2019 | 2.3.37 | EOL | |
| 2.2 | Jun 29, 2010 | — | Yes | 2.2.3.1 | EOL | |
| 2.1 | Oct 29, 2007 | — | Yes | 2.1.8.1 | EOL | |
| 2.0 | Sep 24, 2006 | — | Yes | 2.0.14 | EOL |
CVEs affecting Apache Struts 2.x (0)
Apache Struts 2.x is EOL — migrate to Apache Struts 6.x
Apache Struts 6.x is the next major release. Plan your upgrade before Apache Struts 2.x stops receiving security patches.
Frequently asked questions
Is Apache Struts 2 end of life?
Yes. All Apache Struts 2.x releases have reached end of life and no longer receive security patches. Migrate to Apache Struts 6.x as soon as possible.
What CVEs affect Apache Struts 2?
No CVEs are currently tracked for Apache Struts 2.x in our database. This may mean no vulnerabilities have been recorded yet, or the data is still syncing.
What is the latest Apache Struts 2 version?
The latest Apache Struts 2.x patch release is 2.5.33, released on December 5, 2023. Always run the latest patch to benefit from all security fixes.
How to migrate from Apache Struts 2 to Apache Struts 6?
To migrate from Apache Struts 2 to Apache Struts 6: (1) review the official Apache Struts 6 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run Apache Struts 2 in production?
No. Apache Struts 2 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA