Apache Struts 2 DoS Flaw (CVE-2025-64775) Risks Server Crash via File Leak in Multipart Request Processing

A significant denial-of-service fault has been identified in Apache Struts 2, CVE-2025-66675, which enables a file leak during multipart request processing and can rapidly exhaust server disk space, potentially causing a crash. The issue arises when file upload support is enabled, with temporary files not being properly cleaned up, leading to a disk exhaustion scenario after repeated upload requests.

The advisory notes that the vulnerability spans many Struts releases, including Struts 2.0.0 to 2.3.37 (EOL), 2.5.0 to 2.5.33 (EOL), 6.0.0 to 6.7.4, and 7.0.0 to 7.0.3, and patches have been released to address it. It is recommended to upgrade to Struts 6.8.0 or Struts 7.1.1, or to apply two workarounds for those unable to upgrade: isolate a temporary folder for uploaded files on a limited or dedicated volume, and disable file upload support in the framework if not used. The vulnerability was reported by Nicolas Fournier and is framed as a notable security risk for web applications relying on the framework.