GHSA-xx7v-hqxh-cjr9

ghsaUSosv

Apache Struts is Vulnerable to DoS via File Leak

view advisory published 2025-12-01Licence: CC-BY-4.0

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-64775US	—	1.52% (74th)	—	2025-12-01
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, fro…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/12/01/2WEB
https://cwiki.apache.org/confluence/display/WW/S2-068WEB
https://github.com/apache/strutsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2025-64775ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan