TI-2025-40110 Aliases CVE-2025-64775 GHSA-xx7v-hqxh-cjr9

Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)

MEDIUM 42CWE-459Published 2025-12-01 · Updated 2025-12-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01526 74th percentileScored 2026-11-07

Fix Partial org.apache.struts:struts2-core (Maven): 6.8.0, 7.1.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Struts	2.0.0 – 6.7.0; 7.0.0 – 7.0.3	—	No fix listed	CNA
—	org.apache.struts:struts2-core (Maven)	6.0.0 to before 6.8.0	6.8.0	Patch available	GHSA-xx7v-hqxh-cjr9
—	org.apache.struts:struts2-core (Maven)	7.0.0 to before 7.1.1	7.1.1	Patch available	GHSA-xx7v-hqxh-cjr9
—	org.apache.struts:struts2-core (Maven)	2.0.0 – 2.3.37	—	No fix listed	GHSA-xx7v-hqxh-cjr9
—	org.apache.struts:struts2-core (Maven)	2.5.0 – 2.5.33	—	No fix listed	GHSA-xx7v-hqxh-cjr9

Apache Struts VendorApache Affected 2.0.0 – 6.7.0; 7.0.0 – 7.0.3 Fixed in — No fix listed CNA
org.apache.struts:struts2-core (Maven) Vendor— Affected 6.0.0 to before 6.8.0 Fixed in 6.8.0 Patch available GHSA-xx7v-hqxh-cjr9
org.apache.struts:struts2-core (Maven) Vendor— Affected 7.0.0 to before 7.1.1 Fixed in 7.1.1 Patch available GHSA-xx7v-hqxh-cjr9
org.apache.struts:struts2-core (Maven) Vendor— Affected 2.0.0 – 2.3.37 Fixed in — No fix listed GHSA-xx7v-hqxh-cjr9
org.apache.struts:struts2-core (Maven) Vendor— Affected 2.5.0 – 2.5.33 Fixed in — No fix listed GHSA-xx7v-hqxh-cjr9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:struts::::::::	2.0.0 to before 6.8.0; 7.0.0 to before 7.1.1	Vulnerable	Apache

cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:* Versions 2.0.0 to before 6.8.0; 7.0.0 to before 7.1.1 Vulnerable ·Apache

Remediation

Fix · GHSA-xx7v-hqxh-cjr9 org.apache.struts:struts2-core (Maven) Fixed in 6.8.0 Advisory →
Fix · GHSA-xx7v-hqxh-cjr9 org.apache.struts:struts2-core (Maven) Fixed in 7.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix planned: Will not fix

Not affected: 3 products

Red Hat Enterprise Linux 8
Red Hat JBoss Enterprise Application Platform 8
Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

2026-10-02 Threatist record created from CVE-2025-64775
2026-10-03 Alias added: GHSA-xx7v-hqxh-cjr9

References

Advisory 3

Other 1

https://github.com/apache/struts

TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1

See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences