-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Struts' handling of multipart form fields. The key vulnerable function is JakartaMultiPartRequest.processNormalFormField, which prior to the patch:
The commit introduced a size check against maxStringLength in this method, confirming this was the missing protection. Other changes (like adding configuration parameters) support the fix but aren't themselves vulnerable code.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.struts:struts2-core | maven | < 2.5.31 | 2.5.31 |
| org.apache.struts:struts2-core | maven | >= 6.0.0, < 6.1.2.1 | 6.1.2.1 |