SB2025120157 - Denial of service in Apache Struts

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2025-64775)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling multipart requests. A remote attacker can consume all disk space on the system and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: CVE-2025-66675)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling multipart requests. A remote attacker can consume all available disk space and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://cwiki.apache.org/confluence/display/WW/S2-068
• https://lists.apache.org/thread/rqttr6nft7q53m0q0ymdkcdrmf9kb5lw
• https://lists.apache.org/thread/b83ql12tb8ro5l8xh1z7sto5vsxs04z8