UpHeron
All vulnerabilities

Servers and applications

CVE-2023-41835

When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

Severity
High 7.5
Published
5 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.5.32, 6.3.0.1
Sources
NVD

Affected software

SoftwareAffected versions
Apache StrutsServers and applications · cpe:a:apache:struts
  • From 2.0.0 before 2.5.32
  • From 6.1.2.1 before 6.3.0.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-41835
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-41835