Denial of Service Flaw in Apache Struts Affecting Multiple Versions

CVE-2025-66675

What is CVE-2025-66675?

A Denial of Service vulnerability has been identified in Apache Struts, where improper handling of multipart request processing can lead to disk exhaustion. This vulnerability affects multiple versions of Apache Struts, specifically from versions 2.0.0 up to 6.7.4 and from 7.0.0 to 7.0.3. It is crucial for users to upgrade to versions 6.8.0 or 7.1.1 to mitigate this issue effectively. For additional context, there is a related CVE that highlights an oversight in acknowledging version 6.7.4.

References