Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2025-66675

Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to  https://cve.org/CVERecord?id=CVE-2025-64775  - this CVE addresses missing affected version 6.7.4

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Struts

Default version status: unaffected

  • 2.0.0 to ≤ 6.7.*affected
  • 7.0.0 to ≤ 7.0.*affected

References