CVE-2025-66675: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 7.1.1 - Upgrade
Upgrade
maven/org.apache.struts:struts2-coreto a version that resolves this vulnerability.Fixed in 6.8.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 6.8.0 - Upgrade
Upgrade
Apache Strutsto a version that resolves this vulnerability.Fixed in 7.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66675?
CVE-2025-66675 is classified as a Denial of Service vulnerability.
How do I fix CVE-2025-66675?
To fix CVE-2025-66675, upgrade Apache Struts to version 6.8.0 or 7.1.1.
Which versions of Apache Struts are affected by CVE-2025-66675?
CVE-2025-66675 affects Apache Struts versions from 2.0.0 through 6.7.4 and 7.0.0 through 7.0.3.
What type of issue does CVE-2025-66675 cause?
CVE-2025-66675 causes disk exhaustion due to a file leak in multipart request processing.
Is there a workaround for CVE-2025-66675?
The recommended action for CVE-2025-66675 is to upgrade to a secure version, as no specific workaround is provided.