What is GHSA-xx7v-hqxh-cjr9?

GHSA-xx7v-hqxh-cjr9 is a security advisory published by GitHub Security Advisories with High severity. Apache Struts is Vulnerable to DoS via File Leak

Which CVE IDs does GHSA-xx7v-hqxh-cjr9 cover?

GHSA-xx7v-hqxh-cjr9 covers the following CVE IDs: CVE-2025-64775. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xx7v-hqxh-cjr9?

GHSA-xx7v-hqxh-cjr9 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-xx7v-hqxh-cjr9?

GHSA-xx7v-hqxh-cjr9 affects 4 products, including: maven/org.apache.struts:struts2-core:\u003e= 6.0.0, \u003c 6.8.0; maven/org.apache.struts:struts2-core:\u003e= 7.0.0, \u003c 7.1.1; maven/org.apache.struts:struts2-core:\u003e= 2.0.0, \u003c= 2.3.37; maven/org.apache.struts:struts2-core:\u003e= 2.5.0, \u003c= 2.5.33.

GHSA-xx7v-hqxh-cjr9HighCVSS 7.5

Apache Struts is Vulnerable to DoS via File Leak

Vendor

GitHub Security Advisories

Published

December 1, 2025

Last Modified

December 3, 2025

🔗 CVE IDs covered (1)

CVE-2025-64775 →

📋 Description

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

🎯 Affected products4

maven/org.apache.struts:struts2-core:>= 6.0.0, < 6.8.0
maven/org.apache.struts:struts2-core:>= 7.0.0, < 7.1.1
maven/org.apache.struts:struts2-core:>= 2.0.0, <= 2.3.37
maven/org.apache.struts:struts2-core:>= 2.5.0, <= 2.5.33

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-64775
https://cwiki.apache.org/confluence/display/WW/S2-068
http://www.openwall.com/lists/oss-security/2025/12/01/2
https://github.com/advisories/GHSA-xx7v-hqxh-cjr9