CVE-2025-64775

HIGH

Apache Struts < 6.8.0 - Denial of Service

Title source: rule
STIX 2.1

Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

References (2)

Scores

CVSS v3 7.5
EPSS 0.0012
EPSS Percentile 30.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-459
Status published
Products (2)
apache/struts 2.0.0 - 6.8.0
org.apache.struts/struts2-core 6.0.0 - 6.8.0Maven
Published Dec 01, 2025
Tracked Since Feb 18, 2026