CVE-2025-66675

Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed

Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to  https://cve.org/CVERecord?id=CVE-2025-64775  - this CVE addresses missing affected version 6.7.4

Scores

Weaknesses (CWE)

• CWE-459

Advisories

• GHSA-rg58-xhh7-mqjw — Apache Struts has a Denial of Service vulnerability

European references

• ENISA EUVD · EUVD-2025-202417
• GCVE · GCVE-0-2025-66675

CERT-FR advisories

• CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0327 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.3.37
• cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 2.5.0 ≤ 2.5.33
• cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.8.0
• cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.1.1

Affected products

References

• https://cwiki.apache.org/confluence/display/WW/S2-068
• https://cve.org/CVERecord?id=CVE-2025-64775

Sources