CVE-2023-34396mediumCWE-770

CVE-2023-34396: medium-severity vulnerability in Apache Struts

Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms

Published 14 Jun 2023 · Updated 13 Feb 2025

Follow this CVE + Monitor Apache Struts + Monitor org.apache.struts:struts2-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 5.5%

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

Apache Software Foundation · Apache Struts

Related CVEs — Apache Struts

In the same product, most dangerous first.

CVE-2017-5638CRITICALCVE-2017-5638EPSS 100.0%KEV CVE-2018-11776HIGHCVE-2018-11776EPSS 100.0%KEV CVE-2017-9805HIGHCVE-2017-9805EPSS 99.4%KEV CVE-2017-9791CRITICALCVE-2017-9791EPSS 98.9%KEV CVE-2020-17530CRITICALCVE-2020-17530EPSS 96.3%KEV CVE-2017-12611—CVE-2017-12611EPSS 87.1%

References

https://cwiki.apache.org/confluence/display/WW/S2-064 https://security.netapp.com/advisory/ntap-20230706-0005/http://www.openwall.com/lists/oss-security/2023/06/14/3