oss-sec mailing list archives

S2-064: CVE-2023-34396: Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms

From: Yasser Zamani <yasserzamani () apache org>
Date: Wed, 14 Jun 2023 07:35:56 +0000

Affected versions:

- Apache Struts through 2.5.30
- Apache Struts through 6.1.2

Description:

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This 
issue affects Apache Struts: through 2.5.30, through 6.1.2.

Credit:

Matthew McClain (finder)

References:

https://cwiki.apache.org/confluence/display/WW/S2-064
https://struts.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-34396

Current thread:

S2-064: CVE-2023-34396: Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms Yasser Zamani (Jun 14)