High · published December 10, 2025
⚡ Your server could be brought to its knees with just a multipart request! A denial of service vulnerability in Apache Struts could lead to disk exhaustion faster than you can say 'out of storage!' 🔥 Think of it as a bakery with a never-ending line of orders – if they keep piling up without anyone checking out, eventually the kitchen will overflow and collapse under the weight of all those pastries! An attacker could flood your server with multipart requests, consuming disk space until your service is completely halted. This could mean downtime for your applications, loss of user trust, and potential revenue loss while you scramble to fix the problem.
Think of it as a bakery with a never-ending line of orders – if they keep piling up without anyone checking out, eventually the kitchen will overflow and collapse under the weight of all those pastries! This vulnerability arises in Apache Struts versions 2.0.0 to 6.7.4 and 7.0.0 to 7.0.3, where improper handling of file uploads in multipart requests can lead to disk exhaustion, effectively shutting down your server.
An attacker could flood your server with multipart requests, consuming disk space until your service is completely halted. This could mean downtime for your applications, loss of user trust, and potential revenue loss while you scramble to fix the problem. To protect your environment, upgrade to Apache Struts version 6.8.0 or 7.1.1 immediately. Keep an eye on your server's disk usage and consider implementing rate limiting on uploads to mitigate potential abuse. You've got this! Take these steps, and you'll have your Struts environment secured in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| apache/struts | ≥ 2.0.0, ≤ 2.3.37 | — |
| apache/struts | ≥ 2.5.0, ≤ 2.5.33 | — |
| apache/struts | ≥ 6.0.0, < 6.8.0 | 6.8.0 |
| apache/struts | ≥ 7.0.0, < 7.1.1 | 7.1.1 |