CVE-2025-64775: Apache Struts “File Leak” Vulnerability Threatens Disk Exhaustion

CVE-2025-64775, described as Apache Struts “File Leak,” is a DoS vulnerability that can slowly exhaust disk space by abusing how Struts handles multipart request processing during file uploads. According to The Apache Software Foundation, the flaw allows an attacker to flood a server with specific multipart requests, leaving behind small temporary files that cumulatively fill the disk and paralyse the system.

The vulnerability affects nearly all versions of the Struts framework, with Apache Struts 2 versions 2.0.0 through 6.7.0 and Apache Struts 7 versions 7.0.0 through 7.0.3 identified as affected. Patched binaries have been released, and administrators are urged to upgrade: Struts 6.x users should move to Struts 6.8.0, while Struts 7.x users should move to Struts 7.1.1.

Although it does not enable Remote Code Execution, the DoS impact can disrupt logs, sessions, and data processing, making timely patching vital for business continuity. The advisory details and fixes are linked to S2-068.