Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed (Apache Software Foundation Apache Struts)

CVE-2025-66675

HIGH 8.2

En bref

Source: NVD
EPSS: EPSS 0.59 % · centile 48 (2026-10-29)
État: PUBLISHED
Publiée: 2025-12-10 09:32 UTC
Mise à jour: 2025-12-10 14:53 UTC
Attribuée par: apache
Statut NVD: Analyzed

Rechercher sur…

Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4

Faiblesses (CWE)

CWE-459 — Nettoyage incomplet

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	CISA-ADP
CVSS 3.1	HIGH 8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Avis

GHSA-rg58-xhh7-mqjw — Apache Struts has a Denial of Service vulnerability

Références européennes

ENISA EUVD · EUVD-2025-202417
GCVE · GCVE-0-2025-66675

Avis du CERT-FR

CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0327 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.3.37
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 2.5.0 ≤ 2.5.33
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.8.0
cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.1.1

Produits affectés

Produit	Versions
Apache Software Foundation · Apache Struts	affected 2.0.0 ≤ 6.7.* ; affected 7.0.0 ≤ 7.0.*

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed (Apache Software Foundation Apache Struts)