CVE-2025-66675: Apache Struts Denial of Service Vulnerability in struts2-core Package
Summary
CVE-2025-66675: Apache Struts has a Denial of Service vulnerability. Affects org.apache.struts:struts2-core across 2 version ranges.
>= 2.0.0, < 6.8.0
>= 7.0.0, < 7.1.1
Fixed in 6.8.0 or 7.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is a popular open-source framework for building web applications in Java. It provides a robust architecture for developing enterprise-level applications and supports various features such as MVC architecture, internationalization, and integration with other frameworks. However, certain versions of the struts2-core package are vulnerable to a Denial of Service (DoS) attack due to improper handling of multipart requests, which can lead to disk exhaustion.
Vulnerability Detail
The vulnerability arises from a flaw in the multipart request processing within Apache Struts. When handling multipart requests, the application may inadvertently leak files, causing excessive disk space consumption. This can lead to a Denial of Service, where legitimate users are unable to access the application due to resource exhaustion. The affected versions include struts2-core from 2.0.0 to 6.7.4 and from 7.0.0 to 7.0.3. The CVSS score for this vulnerability is 8.2, indicating a high severity level.
How To Fix
Latest published version: 7.4.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 6.8.06.8.0 -
>= 7.0.0, < 7.1.17.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing rate limiting on file uploads or monitoring disk usage closely to mitigate the impact of this vulnerability until a proper fix can be applied.
Conclusion
The Denial of Service vulnerability in Apache Struts poses a significant risk to applications using affected versions of the struts2-core package. It is crucial for users to upgrade to the latest patched versions to ensure the security and availability of their applications.
See every vulnerability recorded for org.apache.struts:struts2-core →
FAQ
The vulnerability is a Denial of Service (DoS) issue caused by improper handling of multipart requests, leading to disk exhaustion.
The affected versions include struts2-core from 2.0.0 to 6.7.4 and from 7.0.0 to 7.0.3.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Upgrade to the patched versions 6.8.0 or 7.1.1 of the struts2-core package to mitigate the vulnerability.
The CVSS score for this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.struts:struts2-core.
