CVE-2025-64775

Published: Dec 1, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Affected (2)

Products: Apache: Struts

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Struts	From 2.0.0 to 6.8.0
Apache Struts	From 7.0.0 to 7.1.1

Related CWEs

Incomplete Cleanup

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

References (2)

https://cwiki.apache.org/confluence/display/WW/S2-068

Source: security@apache.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2025/12/01/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.