Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-41835: Apache Struts may fill disk with leftover uploads
CVE-2023-41835 · published 2 years ago
Summary
If a file upload request is rejected because some fields are too long, the uploaded files can stay on the server instead of being removed, eventually using up disk space. This affects Apache Struts 2 applications that handle multipart requests. Upgrade to the latest Struts release (2.5.32, 6.1.2.2, 6.3.0.1 or newer) to ensure the temporary files are cleaned up.
What to do
- Update apache org.apache.struts:struts2-core to version 6.3.0.1.
- Update apache org.apache.struts:struts2-core to version 6.1.2.2.
- Update apache org.apache.struts:struts2-core to version 2.5.32.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | apache | org.apache.struts:struts2-core |
>= 6.2.0, < 6.3.0.1 >= 6.0.0, < 6.1.2.2 < 2.5.32 Fix: upgrade to 6.3.0.1
|
| – | apache | struts |
>= 2.0.0, < 2.5.32 >= 6.1.2.1, < 6.3.0.1 cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* |
Original advisory text
Apache Struts: excessive disk usage
When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even if the request has been denied.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.
References
- https://lists.apache.org/thread/6wj530kh3ono8phr642y9sqkl67ys2ft Vendor Advisory
- https://github.com/apache/struts/commit/3292152f8c0a77ee4827beede82b6580478a2c2a
- https://github.com/apache/struts/commit/4c044f12560e22e00520595412830f9582d6dac7
- https://github.com/apache/struts/commit/bf54436869c264941dd192c752a4abfaa65d3711
- https://nvd.nist.gov/vuln/detail/CVE-2023-41835 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/12/09/1
- https://security.netapp.com/advisory/ntap-20231013-0001
- https://github.com/advisories/GHSA-729q-fcgp-r5xh
- https://www.openwall.com/lists/oss-security/2023/12/09/1 URL
- https://security.netapp.com/advisory/ntap-20231013-0001/ Vendor Advisory
- https://repo.maven.apache.org/maven2 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41835... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-459Incomplete Cleanup
Timeline
Published5 Dec 2023
Updated20 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta