Apache Struts 2 Denial-of-Service Vulnerability via File Leak in Multipart Request Processing

A high-severity vulnerability, tracked as CVE-2025-66675, has been identified in Apache Struts 2, affecting versions 2.0.0 through 6.7.4 and 7.0.0 through 7.0.3. The flaw arises from a file leak in the multipart request processing component, which can lead to disk exhaustion and result in a denial-of-service (DoS) condition. Attackers can exploit this vulnerability remotely, potentially causing affected servers to crash by exhausting disk resources. The issue has been addressed in versions 6.8.0 and 7.1.1, and users are strongly advised to upgrade to these fixed versions to mitigate the risk.

The vulnerability is related to improper handling of file uploads in multipart requests, which can allow attackers to trigger uncontrolled file creation or retention, leading to resource exhaustion. Security advisories recommend prompt patching, as the flaw is remotely exploitable and could be leveraged in automated attacks targeting exposed Struts 2 instances. No evidence of exploitation in the wild has been reported as of the latest updates, but the critical nature of the flaw warrants immediate attention from organizations using vulnerable versions.