CVE-2025-64775
published 2025-12-01CVE-2025-64775: Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.46%
70.6th percentile
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | struts | >= 2.0.0 < 6.8.0 | 6.8.0 |
| apache | struts | 2.0.0 – 2.3.37 | — |
| apache | struts | 2.5.0 – 2.5.33 | — |
| apache | struts | >= 6.0.0 < 6.8.0 | 6.8.0 |
| apache | struts | >= 7.0.0 < 7.1.1 | 7.1.1 |
| apache_software_foundation | apache_struts | 2.0.0 – 6.7.* | — |
| apache_software_foundation | apache_struts | 7.0.0 – 7.0.* | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.struts/struts2-core: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
vendor_redhat·2025-12-01·CVSS 7.5
CVE-2025-64775 [HIGH] CWE-459 org.apache.struts/struts2-core: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
org.apache.struts/struts2-core: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
A denial of service vulnerability has been discovered in Apache Struts. A file leak in
multipart request processing causes disk exhaustion when exploited.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stab
OSV
Apache Struts is Vulnerable to DoS via File Leak
osv·2025-12-01
CVE-2025-64775 [HIGH] Apache Struts is Vulnerable to DoS via File Leak
Apache Struts is Vulnerable to DoS via File Leak
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
GHSA
Apache Struts is Vulnerable to DoS via File Leak
ghsa·2025-12-01
CVE-2025-64775 [HIGH] CWE-459 Apache Struts is Vulnerable to DoS via File Leak
Apache Struts is Vulnerable to DoS via File Leak
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-66675 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-66675 [HIGH] CVE-2025-66675 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-66675 :
Java vulnerability analysis and mitigation
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
Source : NVD
## 8.2
Score
Published December 10, 2025
Severity HIGH
CNA Score 8.2
Affected Technologies
Java
Apache Struts
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 31.5
Exploitation Probability (EPSS) 0.1
Affected package
Bugzilla
CVE-2025-64775 google-guice: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) [fedora-42]
bugzilla·2025-12-01·CVSS 7.5
CVE-2025-64775 [HIGH] CVE-2025-64775 google-guice: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) [fedora-42]
CVE-2025-64775 google-guice: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
2025-12-01
Published