Loading vulnerability…
Apache Struts multipart request processing file leak DoS
CVE-2025-64775 is a denial-of-service vulnerability in Apache Struts caused by a file leak during multipart request processing. When the framework handles multipart form submissions for file upload, temporary files are not properly cleaned up under vulnerable conditions, allowing repeated requests to accumulate residual files on disk. This can progressively consume available storage and eventually destabilize or stop the application. Reported affected versions include Apache Struts 2.0.0 through 6.7.0 and 7.0.0 through 7.0.3, with additional reporting indicating the actively maintained 6.x branch is affected through 6.7.4. The issue is tracked by the Apache Struts project as S2-068.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust disk space on the host handling multipart uploads, resulting in denial of service for the Struts application and potentially broader service instability on the affected system. Operational effects can include failed uploads, application errors, inability to create temporary or application files, degraded performance, and server unavailability or crashes if storage exhaustion affects other components.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by disabling Struts file upload functionality where it is not required. For deployments that must accept uploads, place the temporary upload directory on a dedicated volume or in a location with strict size limits and monitoring so leaked temporary files cannot exhaust critical system storage. Implement operational monitoring and automated cleanup for temporary-file growth as a compensating control until patched.
Patch, then assume compromise.
Upgrade Apache Struts to a fixed release. Available fix versions reported for this issue are 6.8.0 and 7.1.1 or later. Organizations running older end-of-life branches should migrate to a supported fixed branch because those lines remain vulnerable. Where downstream products embed Struts, apply the vendor-provided product update that incorporates the corrected Struts version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.