CVE-2025-64775

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cwiki.apache.org/confluence/display/WW/S2-068	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/01/2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:struts::::::::
	cpe:2.3:a:apache:struts::::::::

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de denegación de servicio en Apache Struts, la fuga de archivos en el procesamiento de solicitudes multipart causa el agotamiento del disco. Este problema afecta a Apache Struts: desde 2.0.0 hasta 6.7.0, desde 7.0.0 hasta 7.0.3. Se recomienda a los usuarios actualizar a la versión 6.8.0 o 7.1.1, que soluciona el problema.

Information

Published : 2025-12-01 16:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64775

Mitre link : CVE-2025-64775

CVE.ORG link : CVE-2025-64775

JSON object : View

Products Affected

apache

struts

CWE

CWE-459

Incomplete Cleanup

{"id": "CVE-2025-64775", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64775", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-01T18:22:57.451278Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Struts", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "6.7.0"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.3"}], "packageName": "org.apache.struts:struts2-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2025-12-01T16:15:56.873", "references": [{"url": "https://cwiki.apache.org/confluence/display/WW/S2-068", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/12/01/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de denegaci\u00f3n de servicio en Apache Struts, la fuga de archivos en el procesamiento de solicitudes multipart causa el agotamiento del disco.\n\nEste problema afecta a Apache Struts: desde 2.0.0 hasta 6.7.0, desde 7.0.0 hasta 7.0.3.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 6.8.0 o 7.1.1, que soluciona el problema."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48D11388-EEE4-40F9-939E-E22BF85AFC3D", "versionEndExcluding": "6.8.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D73897-58B2-4229-A621-B651E4797241", "versionEndExcluding": "7.1.1", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}