CVE-2023-34396: 
Java vulnerability analysis and mitigation

CVE-2023-34396 is a vulnerability in Apache Struts that was discovered in June 2023. This vulnerability affects Apache Struts versions through 2.5.30 and through 6.1.2. It is classified as an Allocation of Resources Without Limits or Throttling vulnerability that could lead to a Denial of Service condition (Apache Advisory, OSS Security).

The vulnerability occurs when a Multipart request contains non-file normal form fields. Struts would load these fields into memory as Strings without implementing size checks, potentially leading to Out of Memory (OOM) conditions if the struts.multipart.maxSize parameter is set to a value equal to or greater than the available memory. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

Successful exploitation of this vulnerability could result in a Denial of Service (DoS) condition through Out of Memory errors, potentially affecting the availability of the affected Apache Struts application (NetApp Advisory).

The primary mitigation is to upgrade to Apache Struts version 2.5.31 or 6.1.2.1 or greater. As a workaround, administrators can set the struts.multipart.maxSize parameter to a value significantly smaller than the available memory (Apache Advisory).