CVE-2025-66675

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cve.org/CVERecord?id=CVE-2025-64775	Third Party Advisory
https://cwiki.apache.org/confluence/display/WW/S2-068	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:struts::::::::
	cpe:2.3:a:apache:struts::::::::
	cpe:2.3:a:apache:struts::::::::
	cpe:2.3:a:apache:struts::::::::

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de denegación de servicio en Apache Struts, la fuga de archivos en el procesamiento de solicitudes multipart causa el agotamiento del disco. Este problema afecta a Apache Struts: desde 2.0.0 hasta 6.7.4, desde 7.0.0 hasta 7.0.3. Se recomienda a los usuarios actualizar a la versión 6.8.0 o 7.1.1, que soluciona el problema. Está relacionado con https://cve.org/CVERecord?id=CVE-2025-64775 - esta CVE aborda la versión afectada 6.7.4 que faltaba.

Information

Published : 2025-12-10 10:16

Updated : 2026-10-14 21:10

NVD link : CVE-2025-66675

Mitre link : CVE-2025-66675

CVE.ORG link : CVE-2025-66675

JSON object : View

Products Affected

apache

struts

CWE

CWE-459

Incomplete Cleanup

{"id": "CVE-2025-66675", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66675", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T14:52:50.294504Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Struts", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.*"}], "packageName": "org.apache.struts:struts2-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2025-12-10T10:16:02.170", "references": [{"url": "https://cve.org/CVERecord?id=CVE-2025-64775", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://cwiki.apache.org/confluence/display/WW/S2-068", "tags": ["Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.\n\nIt's related to\u00a0 https://cve.org/CVERecord?id=CVE-2025-64775 \u00a0- this CVE addresses missing affected version 6.7.4"}, {"lang": "es", "value": "Vulnerabilidad de denegaci\u00f3n de servicio en Apache Struts, la fuga de archivos en el procesamiento de solicitudes multipart causa el agotamiento del disco.\n\nEste problema afecta a Apache Struts: desde 2.0.0 hasta 6.7.4, desde 7.0.0 hasta 7.0.3.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 6.8.0 o 7.1.1, que soluciona el problema.\n\nEst\u00e1 relacionado con https://cve.org/CVERecord?id=CVE-2025-64775 - esta CVE aborda la versi\u00f3n afectada 6.7.4 que faltaba."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB32EC52-8599-4E6C-9F87-D2BC050A2531", "versionEndIncluding": "2.3.37", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52DA80BB-35F0-4290-902F-66D27FB9A98F", "versionEndIncluding": "2.5.33", "versionStartIncluding": "2.5.0"}, {"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F8EB632-F594-4D9D-917E-8D20FAAF46DB", "versionEndExcluding": "6.8.0", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D73897-58B2-4229-A621-B651E4797241", "versionEndExcluding": "7.1.1", "versionStartIncluding": "7.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}