CVE-2023-41835

Apache Struts: excessive disk usage

State: Published
Severity: 7.5 High
Published: Dec 5, 2023
Updated: Nov 4, 2025
Reserved: Sep 4, 2023

Description

When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-459 Incomplete Cleanup

Affected Products

Product	Versions
Apache StrutsApache Software Foundation	2.0.0 through 2.5.31Affected 6.1.2.1 through 6.3.0Affected

References

https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ftmailing-listvendor-advisory
https://www.openwall.com/lists/oss-security/2023/12/09/1
https://security.netapp.com/advisory/ntap-20231013-0001/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.