CVE-2025-66675
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Denial of Service vulnerability in Apache Struts — a file leak in multipart request processing causes disk exhaustion. It affects Apache Struts from 2.0.0 through 6.7.4 and from 7.0.0 through 7.0.3.
Risk Assessment
An attacker can fill up the server disk, disrupting application availability and potentially affecting the entire host.
Recommendation
Upgrade Apache Struts to version 6.8.0 or 7.1.1, which fixes the issue.
Other vulnerabilities in Apache Struts
See all- CVE-2016-3090High
The TextParseUtil.translateVariables method in Apache Struts 2.x before version 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression using ANTLR tooling.
- CVE-2016-4461High
Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
- CVE-2017-9804High
In Apache Struts versions 2.3.7 through 2.3.33 and 2.5 through 2.5.12, it is possible to prepare a special URL that can overload the server process during URL validation in a form. This issue exists due to an incomplete fix for S2-047 / CVE-2017-7672.
- CVE-2015-5209High
Apache Struts 2.x before version 2.3.24.1 allows remote attackers to manipulate Struts internals, which may lead to altering user sessions or affecting container settings.
- CVE-2017-9787High
Using Spring AOP functionality to secure Struts actions can lead to a DoS attack.
- CVE-2016-4433High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
- CVE-2016-4431High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 allow remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
- CVE-2016-4430High
Apache Struts 2 versions 2.3.20 through 2.3.28.1 mishandle token validation, allowing remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
- CVE-2016-0785High
Apache Struts 2.x before version 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.
- CVE-2015-1831High
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to compromise internal state of an application via unspecified vectors.
Original NVD description (English source)
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
Vulnerability data from NVD (NIST) · CISA KEV · EPSS