CVE-2025-64775

published 2025-12-01

CVE-2025-64775: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
apache	struts	>= 2.0.0 < 6.8.0	6.8.0
apache	struts	2.0.0 – 2.3.37	—
apache	struts	2.5.0 – 2.5.33	—
apache	struts	>= 6.0.0 < 6.8.0	6.8.0
apache	struts	>= 7.0.0 < 7.1.1	7.1.1
apache_software_foundation	apache_struts	2.0.0 – 6.7.*	—
apache_software_foundation	apache_struts	7.0.0 – 7.0.*	—

CWE-459