CVE-2023-41835 json
Apache Struts: excessive disk usage
published 2023-12-05 2 y ago modified 2026-06-17 4 mo ago also GHSA-729q-fcgp-r5xh , EUVD-2023-3135
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.3%
- EPSS 7.3% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Patch / fix
- maven org.apache.struts:struts2-core 2.5.32, 6.1.2.2, 6.3.0.1
- apache struts 2.5.32, 6.3.0.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-41835 updated cvss 7.5
struts: Excessive disk usage during file upload
-
Red Hat A-MQ Clients 2 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Migration Toolkit for Applications 6 org.apache.struts-struts-core Red Hat Migration Toolkit for Runtimes org.apache.struts-struts-core Red Hat OpenShift Serverless org.apache.struts-struts-core org.apache.struts-struts-core Red Hat AMQ Broker 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat build of Apache Camel for Spring Boot 3 org.apache.struts-struts-core org.apache.struts-struts-corenot affected: vulnerable code not present
+21 more productsfewer
Red Hat build of Debezium 2 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Build of Keycloak org.apache.struts-struts-core org.apache.struts-struts-core Red Hat build of OptaPlanner 8 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat build of Quarkus struts-core Red Hat Data Grid 8 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Decision Manager 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Fuse 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Integration Camel K 1 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Integration Camel Quarkus 2 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Data Grid 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Enterprise Application Platform 6 org.keycloak-keycloak-parent org.keycloak-keycloak-parent, org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Enterprise Application Platform 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Enterprise Application Platform 8 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Enterprise Application Platform Expansion Pack org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Fuse 6 struts-core, org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Fuse Service Works 6 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat JBoss Web Server 5 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Process Automation 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat Single Sign-On 7 org.apache.struts-struts-core org.apache.struts-struts-core Red Hat support for Spring Boot org.apache.struts-struts-core org.apache.struts-struts-core Red Hat streams for Apache Kafka org.apache.struts-struts-core org.apache.struts-struts-core
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
7.30% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >=6.2.0, <6.3.0.1 >=6.0.0, <6.1.2.2 <2.5.32 |
6.3.0.1 6.1.2.2 2.5.32 |
Affected products
- Apache Software Foundation Apache Struts
Classification
- Weakness
-
- CWE-459 Incomplete Cleanup
References
-
github.com
/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a
web
-
github.com
/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac7
web
-
github.com
/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d3711
web
-
lists.apache.org
/thread/6wj530kh3ono8phr642y9sqkl67ys2ft
mailing-list, vendor-advisory, web, release-notes
-
openwall.com
/lists/oss-security/2023/12/09/1
web, mailing-list, third-party-advisory
- security.netapp.com /advisory/ntap-20231013-0001/
-
nvd.nist.gov
/vuln/detail/CVE-2023-41835
advisory
-
github.com
/apache/struts
package
-
security.netapp.com
/advisory/ntap-20231013-0001
web
-
openwall.com
/lists/oss-security/2023/12/09/1
web
Sources
- CVE List CVE-2023-41835
- GitHub Advisory GHSA-729q-fcgp-r5xh
- NVD CVE-2023-41835
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.