high8.2
CVE-2025-66675
Apache Struts has a Denial of Service vulnerability
Impact
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.struts:struts2-core | >= 2.0.0, < 6.8.0 | 6.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Struts | from 2.0.0 through 2.3.37 from 2.5.0 through 2.5.33 from 6.0.0 before 6.8.0 from 7.0.0 before 7.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cve.org/CVERecord?id=CVE-2025-64775
- https://cwiki.apache.org/confluence/display/WW/S2-068
- https://github.com/advisories/GHSA-rg58-xhh7-mqjw
- https://nvd.nist.gov/vuln/detail/CVE-2025-66675
- https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468