CVE-2023-34396
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- Record
CVE-2023-34396- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2023-1686
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- Record
EUVD-2023-1686- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4g42-gqrg-4633
Apache Struts vulnerable to memory exhaustion
Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- Record
GHSA-4g42-gqrg-4633- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- Record
CVE-2023-34396- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- Record
CVE-2023-34396- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-4g42-gqrg-4633
Apache Struts vulnerable to memory exhaustion
Denial of service via out of memory (OOM) owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.
Upgrade to Struts 2.5.31 or 6.1.2.1 or greater
- Record
GHSA-4g42-gqrg-4633- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-coreMaven |
before 2.5.31 | 2.5.31 |
org.apache.struts:struts2-coreMaven |
6.0.0 up to 6.1.2.1 | 6.1.2.1 |
org.apache.struts:struts-coreMaven |
through 1.3.10 | None known |
struts:strutsMaven |
through 1.2.9 | None known |
org.apache.struts:struts2-coreMaven |
before 2.5.31, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 45 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.12.2.32.2.3.12.3.12.3.1.12.3.1.22.3.122.3.142.3.14.12.3.14.22.3.14.32.3.152.3.15.12.3.15.22.3.15.32.3.162.3.16.12.3.16.22.3.16.32.3.202.3.20.12.3.20.32.3.242.3.24.12.3.24.32.3.282.3.28.12.3.292.3.32.3.302.3.312.3.322.3.332.3.342.3.352.3.36 |
2.5.31 |
org.apache.struts:struts2-coreMaven |
6.0.0 up to 6.1.2.1, plus listed versions 6.0.36.1.16.1.2 |
6.1.2.1 |
org.apache.struts:struts-coreMaven |
through 1.3.10, plus listed versions 1.3.51.3.81.3.9 |
None known |
struts:strutsMaven |
through 1.2.9, plus listed versions 1.0.21.11.1-b2-200211241.1-b31.1-beta-2 Show 6 moreShow less1.1-rc11.1-rc21.2.21.2.41.2.71.2.8 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34396 is a medium vulnerability (CVSS 4.3) in Apache Struts, published June 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.51%, the 92nd percentile. Fixed in org.apache.struts:struts2-core 2.5.31.
References
Left out here: 33 versions. The JSON record has them.