VYPR
← All advisories
High severity8.2OSV Advisory· Published Dec 10, 2025· Updated Jun 17, 2026

CVE-2025-66675

CVE-2025-66675

Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

It's related to  https://cve.org/CVERecord?id=CVE-2025-64775  - this CVE addresses missing affected version 6.7.4

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.struts:struts2-coreMaven
>= 2.0.0, < 6.8.06.8.0
org.apache.struts:struts2-coreMaven
>= 7.0.0, < 7.1.17.1.1

Affected products

3
  • Apache/StrutsOSV2 versions
    STRUTS_2_3_24, STRUTS_2_3_24_1, STRUTS_2_3_25, …+ 1 more
    • (no CPE)range: STRUTS_2_3_24, STRUTS_2_3_24_1, STRUTS_2_3_25, …
    • cpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*range: >=2.0.0,<=2.3.37
  • ghsa-coords
    pkg:maven/org.apache.struts/struts2-core
    Range: >= 2.0.0, < 6.8.0

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.