CVE-2025-66675: 
Java vulnerability analysis and mitigation

CVE-2025-66675 is a Denial of Service vulnerability in Apache Struts caused by a file leak in multipart request processing that leads to disk exhaustion. It affects Apache Struts versions 2.0.0 through 2.3.37 (EOL), 2.5.0 through 2.5.33 (EOL), 6.0.0 through 6.7.4, and 7.0.0 through 7.0.3. The vulnerability was disclosed on December 10, 2025, and is closely related to CVE-2025-64775 — this CVE specifically addresses the missing affected version 6.7.4 from that earlier advisory. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Apache S2-068).

The root cause is classified as CWE-459 (Incomplete Cleanup): when file upload support is enabled, temporary files created during multipart request processing are not properly cleaned up after use, causing them to accumulate on disk (Apache S2-068, GitHub Advisory). An unauthenticated remote attacker can exploit this by repeatedly sending crafted multipart HTTP requests, causing the server's disk to fill up and rendering the application unavailable. No authentication or user interaction is required, and attack complexity is low. The vulnerability was reported by Nicolas Fournier and is tracked under the Apache security bulletin S2-068 (Apache S2-068).

Successful exploitation allows an unauthenticated remote attacker to exhaust the disk space of the host running Apache Struts, causing a complete Denial of Service for the affected application. There is also a low confidentiality impact, as the file leak may expose temporary file contents to unauthorized parties. Availability impact is rated High, meaning the application can be rendered entirely unavailable, potentially affecting dependent services and causing significant operational downtime (GitHub Advisory, Apache S2-068).

1. Reconnaissance: Identify internet-facing Apache Struts applications running affected versions (2.0.0–6.7.4 or 7.0.0–7.0.3) using tools like Shodan, Censys, or web application fingerprinting techniques.
2. Confirm file upload support: Verify that the target application has file upload functionality enabled (the default in most Struts deployments), which is required for the vulnerability to be triggered.
3. Craft multipart requests: Construct HTTP POST requests with multipart/form-data content type, including file upload payloads targeting any Struts action that processes file uploads.
4. Send repeated requests: Automate the sending of large volumes of these crafted multipart requests to the target server, causing temporary files to be created on disk without being cleaned up.
5. Achieve disk exhaustion: As temporary files accumulate, the server's disk fills up, causing the Struts application and potentially the entire host to become unavailable (DoS) (Apache S2-068, Indusface Blog).

• File System: Rapid accumulation of temporary files in the system's or application's configured temp directory (e.g., /tmp, java.io.tmpdir) with names consistent with Struts multipart upload artifacts; disk usage growing abnormally fast on the partition hosting the temp directory.
• Logs: High volume of multipart POST requests in web server or application access logs from one or multiple source IPs; repeated requests to file-upload-enabled Struts action endpoints; disk-full or I/O error messages in application logs.
• Network: Unusual spikes in inbound HTTP POST traffic, particularly with Content-Type: multipart/form-data headers; sustained high-bandwidth requests from external IPs targeting upload endpoints.
• System: Disk utilization alerts on the server; application errors or crashes due to inability to write to disk; Java process generating large numbers of temporary files without corresponding cleanup (Apache S2-068, Indusface Blog).

The recommended remediation is to upgrade Apache Struts to version 6.8.0 (for the 6.x branch) or 7.1.1 (for the 7.x branch), both of which fix the incomplete cleanup issue (Apache S2-068, GitHub Advisory). For organizations unable to patch immediately, the Apache advisory recommends configuring a dedicated temporary folder with limited disk size for uploaded files, so that exhaustion does not affect system-critical partitions. Alternatively, disabling file upload support in the framework entirely is an effective workaround if the feature is not required. Network-level rate limiting on multipart upload endpoints can also reduce exposure while patching is underway (Apache S2-068).

The vulnerability received coverage from security news outlets including SecurityOnline.info and Indusface, which published technical blog posts highlighting the risk of server crashes via disk exhaustion (Indusface Blog). The Apache Struts team rated the security impact as "Important" and published the S2-068 bulletin with clear remediation guidance (Apache S2-068). Social media discussion was noted on Bluesky, and the vulnerability was picked up by multiple vulnerability tracking platforms shortly after disclosure. Red Hat also acknowledged the CVE in their security advisory database (Red Hat CVE).