High
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
Type: advisorySources: OSV
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-66675
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 23:08 UTC · Revision 1
Source evidence
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
core-osv · Original sourcePublished 10 Dec 2025, 09:32 UTC
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
osv:CVE-2025-66675
Complete source record
{
"id": "637e9212a3dbb30da49693faed0bbfecb61ee9bf4e41710d7a76c4b13d54dce9",
"url": "https://osv.dev/vulnerability/CVE-2025-66675",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed",
"summary": "Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue. It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4",
"evidence": "osv:CVE-2025-66675",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-66675",
"aliases": [
"CVE-2025-66675",
"GHSA-rg58-xhh7-mqjw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/struts",
"type": "GIT",
"events": [
{
"introduced": "2c0a197cea8fdc7d8cda5eeaa15a1c76507ac0a5"
},
{
"last_affected": "60a1a2642ae7ddf74c0062fe37b3b57f83a0588e"
},
{
"introduced": "0"
},
{
"last_affected": "ca8d57c538136983a0180ac508ebcfabaf73f839"
},
{
"introduced": "68fb49c10e083dce829476778eec726fc90c8c38"
},
{
"fixed": "80225c7169436985c002ad258e6fd341c766829b"
},
{
"introduced": "1d95543fbf2c873d5dab1773f951c38e3220b4e5"
},
{
"fixed": "08a5eddc33c48a38fa3732fca0d216510c52dbab"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"last_affected": "2.3.37"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.5.0"
},
{
"last_affected": "2.5.33"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.8.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.1.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"STRUTS_6_7_4",
"STRUTS_6_7_3",
"STRUTS_7_0_3",
"STRUTS_6_7_2",
"STRUTS_7_0_2",
"STRUTS_6_7_1",
"STRUTS_7_0_1",
"STRUTS_6_7_0",
"STRUTS_7_0_0",
"STRUTS_6_6_1",
"STRUTS_6_6_0",
"STRUTS_6_5_0",
"STRUTS_6_4_0",
"STRUTS_2_3_37",
"STRUTS_2_5_33",
"STRUTS_6_3_0_1",
"STRUTS_6_2_0",
"STRUTS_2_5_32",
"STRUTS_6_3_0",
"STRUTS_2_5_31",
"STRUTS_6_1_1",
"STRUTS_6_1_0",
"STRUTS_6_0_3",
"STRUTS_6_0_2",
"STRUTS_6_0_1",
"STRUTS_6_0_0",
"STRUTS_2_5_30",
"STRUTS_2_5_29",
"STRUTS_2_5_28_3",
"STRUTS_2_5_28_2",
"STRUTS_2_5_28_1",
"STRUTS_2_5_28",
"STRUTS_2_5_27",
"STRUTS_2_5_26",
"STRUTS_2_5_25",
"STRUTS_2_5_24",
"STRUTS_2_5_23",
"STRUTS_2_5_22",
"STRUTS_2_5_21",
"STRUTS_2_5_20",
"STRUTS_2_5_19",
"STRUTS_2_5_18",
"STRUTS_2_3_36",
"STRUTS_2_5_17",
"STRUTS_2_3_35",
"STRUTS_2_5_16",
"STRUTS_2_5_15",
"STRUTS_2_5_14_1",
"STRUTS_2_5_14",
"STRUTS_2_5_13",
"STRUTS_2_3_34",
"STRUTS_2_3_33",
"STRUTS_2_5_12",
"STRUTS_2_5_11",
"STRUTS_2_3_32",
"STRUTS_2_5_10",
"STRUTS_2_5_9",
"STRUTS_2_5_8",
"STRUTS_2_5_7",
"STRUTS_2_5_6",
"STRUTS_2_5_5",
"STRUTS_2_5_4",
"STRUTS_2_3_31",
"STRUTS_2_5_3",
"STRUTS_2_3_30",
"STRUTS_2_3_29",
"STRUTS_2_3_28",
"STRUTS_2_3_24_1",
"STRUTS_2_3_27",
"STRUTS_2_3_26",
"STRUTS_2_3_25",
"STRUTS_2_5_BETA2",
"STRUTS_2_3_24",
"STRUTS_2_5_BETA1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66675.json"
}
}
],
"modified": "2026-10-28T02:30:24.229787836Z",
"provider": "osv",
"references": [
"https://cve.org/CVERecord?id=CVE-2025-64775",
"https://repo.maven.apache.org/maven2",
"https://cwiki.apache.org/confluence/display/WW/S2-068",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66675.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-66675"
],
"provider_metadata": {
"cwe_ids": [
"CWE-459"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "2.0.0"
},
{
"last_affected": "6.7.*"
},
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.*"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66675.json"
}
},
"related_cves": [
{
"value": "CVE-2025-66675",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 490765,
"published_at": "2025-12-10T09:32:58.536+00:00"
}