Loading vulnerability…
Apache Struts multipart request processing disk exhaustion DoS
CVE-2025-66675 is a denial-of-service vulnerability in Apache Struts caused by incomplete cleanup of temporary files created during multipart request processing. When the framework handles multipart/form-data requests, leaked temporary files can accumulate on disk instead of being properly removed. Repeated requests can therefore consume available storage and trigger disk exhaustion. The issue affects Apache Struts versions 2.0.0 through 6.7.4 and 7.0.0 through 7.0.3. The vulnerability is associated with multipart handling in the framework rather than a specific application feature implementation, creating an availability risk for deployments that process or expose multipart request handling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust disk space on the target system, causing denial of service. As storage is depleted, affected applications may become unstable, stop responding, fail to process requests, or crash, and the broader host may also experience operational degradation. The primary impact is on availability, with potentially significant service disruption for exposed production systems.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting or disabling multipart upload handling where not required, applying rate limiting to endpoints that accept multipart/form-data requests, isolating and tightly sizing temporary storage used by the application, and monitoring disk consumption with alerting to detect abnormal growth. These measures may reduce exploitation impact but do not fully remediate the vulnerability.
Patch, then assume compromise.
Upgrade Apache Struts to a fixed release. The issue is fixed in Apache Struts 6.8.0 and 7.1.1. Organizations running affected versions should update to the appropriate supported branch and validate multipart upload handling after deployment of the patch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.