CVE-2025-64775: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64775?
CVE-2025-64775 is a denial of service vulnerability that can lead to disk exhaustion in affected versions of Apache Struts.
How do I fix CVE-2025-64775?
To fix CVE-2025-64775, upgrade Apache Struts to version 6.8.0 or 7.1.1.
Which versions of Apache Struts are affected by CVE-2025-64775?
CVE-2025-64775 affects Apache Struts versions from 2.0.0 through 6.7.0 and from 7.0.0 through 7.0.3.
What type of issue does CVE-2025-64775 represent in Apache Struts?
CVE-2025-64775 represents a denial of service issue caused by file leak in multipart request processing.
Can CVE-2025-64775 lead to data loss?
While CVE-2025-64775 primarily causes denial of service, the disk exhaustion could potentially lead to data loss in critical systems.