Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 09 Dec 2023 06:55:17 +0000
From: Lukasz Lenart <>
Subject: CVE-2023-41835: Apache Struts: excessive disk usage 

Severity: moderate

Affected versions:

- Apache Struts 2.0.0 through 2.5.31
- Apache Struts through 6.3.0


When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or or Struts or greater, which fixe this issue.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.