CVE-2023-41835
Apache Struts: excessive disk usage
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
- Record
CVE-2023-41835- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
CVE List
Apache Struts: excessive disk usage
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
- Record
CVE-2023-41835- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
EUVDEUVD-2023-3135
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
- Record
EUVD-2023-3135- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-729q-fcgp-r5xh
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.
- Record
GHSA-729q-fcgp-r5xh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
OSV
Apache Struts: excessive disk usage
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
- Record
CVE-2023-41835- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
OSVGHSA-729q-fcgp-r5xh
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fix this issue.
- Record
GHSA-729q-fcgp-r5xh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-459
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
6.2.0 up to 6.3.0.1 | 6.3.0.1 |
org.apache.struts:struts2-coreMaven |
6.0.0 up to 6.1.2.2 | 6.1.2.2 |
org.apache.struts:struts2-coreMaven |
before 2.5.32 | 2.5.32 |
org.apache.struts:struts2-coreMaven |
6.2.0 up to 6.3.0.1, plus listed versions 6.3.0 |
6.3.0.1 |
org.apache.struts:struts2-coreMaven |
6.0.0 up to 6.1.2.2, plus listed versions 6.0.36.1.16.1.26.1.2.1 |
6.1.2.2 |
org.apache.struts:struts2-coreMaven |
before 2.5.32, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 45 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36 |
2.5.32 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41835 is a high vulnerability (CVSS 7.5) in Apache Struts, published December 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.30%, the 94th percentile. Fixed in org.apache.struts:struts2-core 6.3.0.1.
References
lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft
openwall.com/lists/oss-security/2023/12/09/1
security.netapp.com/advisory/ntap-20231013-0001
nvd.nist.gov/vuln/detail/CVE-2023-41835
github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a
Left out here: 34 versions. The JSON record has them.