{"id":"CVE-2025-66675","title":"Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade …","summary":"Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade …","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-459"],"vendor":"apache","product":"struts","affected":["struts >= 2.0.0, <= 2.3.37","struts >= 2.5.0, <= 2.5.33","struts >= 6.0.0, < 6.8.0","struts >= 7.0.0, < 7.1.1"],"patched":["struts 7.1.1"],"published":"2025-12-10","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66675","references":[{"url":"https://cve.org/CVERecord?id=CVE-2025-64775","label":"security@apache.org"},{"url":"https://cwiki.apache.org/confluence/display/WW/S2-068","label":"security@apache.org"}],"tags":["nvd"],"epss":0.00594,"epssPercentile":0.47148,"ingestedAt":"2026-10-14T21:57:04.780Z","slug":"CVE-2025-66675","body":"## Overview\n\nDenial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.\n\nThis issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.\n\nUsers are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.\n\nIt's related to  https://cve.org/CVERecord?id=CVE-2025-64775  - this CVE addresses missing affected version 6.7.4\n\n## Affected\n\n- `struts >= 2.0.0, <= 2.3.37`\n- `struts >= 2.5.0, <= 2.5.33`\n- `struts >= 6.0.0, < 6.8.0`\n- `struts >= 7.0.0, < 7.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `struts 7.1.1`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}