Overview
Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.
A Denial of Service (DoS) vulnerability (CVE-2025-48976) has been identified in Apache Commons Fileupload, which allows attackers to exhaust server memory by uploading specially crafted uploads, potentially rendering the application unresponsive. Apache Commons Fileupload is used for fileuploads in Apache Struts.
Per OWASP:The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.
This issue affects multiple versions of Apache Struts 1 that rely on commons-fileupload.
Details
Module Info
- Product: Apache Struts 1
- Affected packages: commons-fileupload
- Affected versions:
- Apache Struts: <=1.3.10
- Apache Commons Fileupload: <=1.5.0
- GitHub repository: https://github.com/apache/commons-fileupload
- Package manager: Maven
- Published packages:
- Fixed in: NES for Struts Struts 1
Vulnerability Info
A Denial of Service (DoS) vulnerability (CVE-2025-48976) has been identified in Apache Commons Fileupload, which allows attackers to exhaust server memory by crafting multipart uploads with a high number of parts containing excessively large headers. This issue is addressed in versions 1.6 and 2.0.0-M5 with the introduction of the PartHeaderSizeMax configuration parameter and by limiting the number of parts.
Mitigation
Struts 1 is no longer community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade affected applications to supported versions of Struts.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- TERASOLUNA Framework Security Team of NTT DATA Group Corporation
