ognl vulnerabilities

Products

• ognl/ognl 2

Latest ognl CVEs

Newest publication first

1. CVE-2026-113730 OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

   Published 2026-10-20

   Medium·CVSS 5.6 EPSS 0.39%

   OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or java.l...

2. CVE-2016-3093 Denial of service in Apache Struts

   Published 2016-06-07

   Medium·CVSS 5.3 EPSS 8.4%

   Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.