CVE-2023-34396

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-34396
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34396.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-34396
Aliases
Published
2023-06-14T07:50:59.730Z
Modified
2026-07-15T01:49:05.725268577Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
Details

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34396.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.5.30"
                },
                {
                    "last_affected": "6.1.2"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "fixed": "2.5.30"
                },
                {
                    "fixed": "6.1.2"
                }
            ]
        }
    ],
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/apache/struts

Affected ranges

Type
GIT
Repo
https://github.com/apache/struts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8274f77bc1648355c0292e7e50c489d233f9b212
Introduced
68fb49c10e083dce829476778eec726fc90c8c38
Fixed
28498a807d4741f1438aedf6da6a26fe8d20a97a
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.31"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.1.2.1"
        }
    ],
    "cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*"
}

Affected versions

Other
STRUTS_2_5_10
STRUTS_2_5_11
STRUTS_2_5_12
STRUTS_2_5_13
STRUTS_2_5_14
STRUTS_2_5_14_1
STRUTS_2_5_15
STRUTS_2_5_16
STRUTS_2_5_17
STRUTS_2_5_18
STRUTS_2_5_19
STRUTS_2_5_20
STRUTS_2_5_21
STRUTS_2_5_22
STRUTS_2_5_23
STRUTS_2_5_24
STRUTS_2_5_25
STRUTS_2_5_26
STRUTS_2_5_27
STRUTS_2_5_28
STRUTS_2_5_28_1
STRUTS_2_5_28_2
STRUTS_2_5_28_3
STRUTS_2_5_29
STRUTS_2_5_3
STRUTS_2_5_30
STRUTS_2_5_4
STRUTS_2_5_5
STRUTS_2_5_6
STRUTS_2_5_7
STRUTS_2_5_8
STRUTS_2_5_9
STRUTS_2_5_BETA1
STRUTS_2_5_BETA2
STRUTS_6_0_0
STRUTS_6_0_1
STRUTS_6_0_2
STRUTS_6_0_3
STRUTS_6_1_0
STRUTS_6_1_1
STRUTS_6_1_2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34396.json"