SummaryDoS via OOM owing to no sanity limit on normal form fields in multipart forms.
Who should read this
All Struts 2 developers and users
Impact of vulnerability
Denial of Service
Maximum security rating
Upgrade to Struts 2.5.31 or 22.214.171.124 or greater
Struts 2.0.0 - Struts 6.1.2
When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.
Upgrade to Struts 2.5.31 or 126.96.36.199 or greater.
No issues expected when upgrading to Struts 2.5.31 or 188.8.131.52
Set struts.multipart.maxSize to a value much much smaller than the available memory.