CVE-2025-66675High· 8.2▾ TwilightDenial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
struts >= 2.0.0, <= 2.3.37struts >= 2.5.0, <= 2.5.33struts >= 6.0.0, < 6.8.0struts >= 7.0.0, < 7.1.1Upgrade past the affected range:
struts 7.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2023-42794Medium· 5.9Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a poten…
CVE-2020-26258Medium· 6.3XStream is a Java library to serialize objects to XML and back again
CVE-2020-26259Medium· 6.8XStream is a Java library to serialize objects to XML and back again
CVE-2026-104713Medium· 6.5Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
CVE-2026-104714High· 8.8Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts
CVE-2026-104711Critical· 9.8Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts