ognl:ognl

Maven2 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting ognl:ognlpage 1 of 1

CVE-2016-3093MEDIUMCVSS 5.3EG 5.3fixed in 3.0.12
2016-06-07
vulnerable: 2.1.4 ... 3.0.9 (27 versions)
Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
CVE-2026-113730MEDIUMCVSS 5.6EG 5.6fixed in 3.4.13
2026-10-20
vulnerable: 2.1.4 ... 3.4.9 (107 versions)
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method,…

Check whether ognl:ognl is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for ognl:ognl CVEs against the assets you own.

Book a Demo →