What is GHSA-rg58-xhh7-mqjw?

GHSA-rg58-xhh7-mqjw is a security advisory published by GitHub Security Advisories with High severity. Apache Struts has a Denial of Service vulnerability

Which CVE IDs does GHSA-rg58-xhh7-mqjw cover?

GHSA-rg58-xhh7-mqjw covers the following CVE IDs: CVE-2025-66675. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rg58-xhh7-mqjw?

GHSA-rg58-xhh7-mqjw has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-rg58-xhh7-mqjw?

GHSA-rg58-xhh7-mqjw affects 2 products, including: maven/org.apache.struts:struts2-core:\u003e= 2.0.0, \u003c 6.8.0; maven/org.apache.struts:struts2-core:\u003e= 7.0.0, \u003c 7.1.1.

GHSA-rg58-xhh7-mqjwHighCVSS 8.2

Apache Struts has a Denial of Service vulnerability

Vendor

GitHub Security Advisories

Published

December 10, 2025

Last Modified

December 10, 2025

🔗 CVE IDs covered (1)

CVE-2025-66675 →

📋 Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

🎯 Affected products2

maven/org.apache.struts:struts2-core:>= 2.0.0, < 6.8.0
maven/org.apache.struts:struts2-core:>= 7.0.0, < 7.1.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-66675
https://cve.org/CVERecord?id=CVE-2025-64775
https://cwiki.apache.org/confluence/display/WW/S2-068
https://github.com/apache/struts/commit/831568929cfba700f790f6ebe6e335f9f33fb468
https://github.com/advisories/GHSA-rg58-xhh7-mqjw