CVE-2023-41835: 
Java vulnerability analysis and mitigation

CVE-2023-41835 is a vulnerability discovered in Apache Struts that affects versions 2.0.0 through 2.5.31 and 6.1.2.1 through 6.3.0. The vulnerability was initially recorded on September 4, 2023, and involves an incomplete cleanup issue where uploaded files remain in the struts.multipart.saveDir directory even when a multipart request is denied due to fields exceeding the maxStringLength limit (NVD, OSS Security).

The vulnerability is classified under CWE-459 (Incomplete Cleanup) and has received a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U), with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (NVD).

The primary impact of this vulnerability is related to system availability and resource consumption. When exploited, it can lead to excessive disk usage as files remain in the storage directory even after request denial, potentially causing disk space exhaustion (OSS Security).

Users are recommended to upgrade to Apache Struts versions 2.5.32, 6.1.2.2, or 6.3.0.1 or greater, which contain fixes for this vulnerability (OSS Security).