Vulnerability record · CVE-2023-41835 · published 5 December 2023
CVE-2023-41835: Apache struts vulnerability
Apache · Struts
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Description
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft | Mailing ListRelease Notes |
| https://www.openwall.com/lists/oss-security/2023/12/09/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft | Mailing ListRelease Notes |
| https://security.netapp.com/advisory/ntap-20231013-0001/ | |
| https://www.openwall.com/lists/oss-security/2023/12/09/1 | Mailing ListThird Party Advisory |
Track CVE-2023-41835 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-41835), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
