How to Set the MaxRequestParameterCount Value in WebLogic Server to Avoid MaxRequestParameterExceedException (Doc ID 1505598.1)

Last updated on DECEMBER 14, 2022

Applies to:

Details

This document is provided in conjunction with a Security Advisory and Critical Patch Update. A security vulnerability was identified where malicious users could send HTTP requests with so many parameters as to overload the WebLogic Server (WLS) domain. This vulnerability was addressed in the January 2013 CPU. See the security alerts page at http://www.oracle.com/technetwork/topics/security/alerts-086861.html and the January 2013 Patch Availability Document (PAD) at <Note 1502461.1> referring to CVE-2011-5035. This will be cumulative going forward for PSUs and new releases for WebLogic Server.

If this is not set, one may receive errors if exceeding the limit. (see bottom of this document). To support this fix and allow control for application requirements, a new parameter has been set up in WLS: MaxRequestParameterCount.

Setting this value limits the number of parameters allowed in a request, which prevents the system from being overloaded. Following are instructions on how to set this parameter.

Actions

The MaxRequestParameterCount attribute can be set in two places:

1. On the WebServerMBean, which is a child of the ServerMBean and provides settings that have effect only for the server instance to which the WebServerMBean belongs.
2. On the VirtualHostMBean. Virtual hosts, like servers, are children of the DomainMBean. Settings on the VirtualHostMBean override corresponding settings on the WebServerMBean.

One must use WLST to set the MaxRequestParameterCount attribute, as shown below. Please note the following:

• <admin_user> represents an administrative user for the target domain.
• <admin_pwd> represents the password for <admin_user>.
• <admin_url> represents the URL to connect to the domain's admin server; e.g., "t3://<host>:<port>" or "t3s://<host>:<port>".
• <domain_name> represents the name of the domain being managed, default, "mydomain".
• <server_name> represents the name of a server being managed, default, "myserver".
• <virtual_host> represents the name of a virtual host being managed, default, "VirtualHost-0".

For WebServerMBean:

An application may be reproducing this in different ways. A smaller code sample to reproduce is given in the following document to help test the settings and compare with testing: <Note 1906952.1> Sample Code to Reproduce MaxRequestParameterExceedException

Contacts

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.