Denial of Service Vulnerability in Apache Struts by Apache

CVE-2025-64775

What is CVE-2025-64775?

CVE-2025-64775 is a denial of service vulnerability found in Apache Struts, a widely used open-source framework for building Java web applications. This vulnerability manifests during the processing of multipart requests, specifically leading to a file leak that can cause significant disk exhaustion. Organizations leveraging Apache Struts in their web applications may face severe operational challenges due to this vulnerability, as it enables attackers to overload server resources, ultimately disrupting service availability and user access. Affected versions include Apache Struts from 2.0.0 through 6.7.0 and from 7.0.0 through 7.0.3. To mitigate the risk posed by CVE-2025-64775, users are strongly advised to upgrade to versions 6.8.0 or 7.1.1, which contain the necessary fixes.

Potential impact of CVE-2025-64775

1. Service Disruption: The primary impact of this vulnerability is the potential for service disruption. By exploiting the denial of service condition, attackers can render applications inoperable, leading to downtime and the inability for legitimate users to access the services.

2. Resource Exhaustion: The vulnerability causes disk exhaustion by leaking files during multipart request processing. This resource drain can severely hamper server performance, leading to slow response times, increased latency, and the need for emergency interventions to restore system functionality.

3. Reputational Damage: Organizations affected by this vulnerability may suffer reputational harm due to prolonged outages or degraded performance. This can erode customer trust and impact business relationships, especially for those relying on Apache Struts for critical application functionality.

News Articles

CybersecurityNews

CVE-2025-64775

Apache Struts Vulnerability Let Attackers Trigger Disk Exhaustion Attacks

Researchers found a flaw in Apache Struts that could allow attackers to trigger disk exhaustion attacks, rendering affected systems unusable.

6 days ago

Cyber Press

CVE-2025-64775

Apache Struts Vulnerability Lets Attackers Trigger Disk Exhaustion Attacks

The flaw, identified as CVE-2025-64775, enables attackers to perform disk exhaustion denial-of-service (DoS) attacks that can render affected systems completely unavailable.

6 days ago

References