Allocation of Resources Without Limits or Throttling Affecting org.apache.struts:struts2-core package, versions [2.5.1,2.5.31) [6.1.2,6.1.2.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESTRUTS-5707102
- published 14 Jun 2023
- disclosed 14 Jun 2023
- credit Matthew McClain
Introduced: 14 Jun 2023
CVE-2023-34396 Open this link in a new tabHow to fix?
Upgrade org.apache.struts:struts2-core to version 2.5.31, 6.1.2.1 or higher.
Overview
org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when it loads non-file regular form fields from a Multipart request into memory as Strings without verifying their sizes.
This vulnerability can be exploited if a developer has set struts.multipart.maxSize to a value equal to or greater than the available memory.