CVE-2025-66675

Overview

Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications. 

‍

A Denial of Service vulnerability (CVE-2025-66675) has been identified in Apache Struts. This issue arises from a file leak during multipart request processing, which can lead to disk exhaustion and cause service disruption.

‍

Per OWASP, a Denial of Service (DoS) attack aims to make a system, application, or service unavailable for its intended use. DoS conditions can be triggered through overwhelming request volumes, exploitation of programming flaws, or improper handling of system resources, ultimately preventing legitimate users from accessing the service. In some cases, attackers may even inject or execute arbitrary code while carrying out a DoS attack, escalating the impact. These attacks can cause severe degradation in service quality, including long response delays, excessive failures, and complete service outages, resulting in a direct and significant impact on availability.

‍

This issue affects multiple versions of Apache Struts.

‍

Details

Module Info

• Product: Apache Struts 2
• Affected packages: struts2-core
• OSS Affected versions: >=2.0.0 <=2.3.37, >=2.5.0 <=2.5.33, >=6.0.0 <6.8.0, >=7.0.0 <7.1.1
• NES Affected versions: >=2.5.33-struts2-2.5.34 <2.5.33-struts2-2.5.38
• GitHub repository: https://github.com/apache/struts
• Package manager: Maven
• Fixed in: NES for Apache Struts Struts 2 v2.5.38

‍

Vulnerability Info

CVE-2025-66675 builds on CVE-2025-64775 by updating the affected versions to include <=6.7.4. For background and additional details see CVE-2025-64775.

‍

Mitigation

Users of the affected components should apply one of the following mitigations:

• Upgrade to patched Apache Struts 2
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• Nicolas Fournier