Vulnerability GHSA-xx7v-hqxh-cjr9
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
10 months ago
December 01, 2025 at 06:30 PM UTC
Apache Struts is Vulnerable to DoS via File Leak
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3
2.0.5 - 2.3.37 and 2.5 - 6.7.4 and 7.0.0 - 7.0.3
Summary
Apache Struts is Vulnerable to DoS via File Leak
Details
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
9 months ago
Apache Struts 2 is Missing XML Validation
2.0.5 - 2.3.37 and 2.5 - 6.0.3 GHSA-qcfc-hmrc-59x7
2.0.5 - 2.3.37 and 2.5 - 6.0.3 GHSA-qcfc-hmrc-59x7
High Risk
10 months ago
Apache Struts has a Denial of Service vulnerability
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
2.0.5 - 6.7.4 and 7.0.0 - 7.0.3 GHSA-rg58-xhh7-mqjw
Critical
1 year ago
Apache Struts file upload logic is flawed
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
2.0.5 - 6.3.0.2 GHSA-43mq-6xmg-29vm
Critical
2 years ago
Apache Struts vulnerable to path traversal
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1 GHSA-2j39-qcjm-428w
2.0.5 - 2.5.32 and 6.0.0 - 6.3.0.1 GHSA-2j39-qcjm-428w
High Risk
2 years ago
Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0 GHSA-729q-fcgp-r5xh
2.0.5 - 2.5.31 and 6.0.0 - 6.1.2.1 and 6.2.0 - 6.3.0 GHSA-729q-fcgp-r5xh
Impacted packages
Timeline
Published
10 months ago
December 01, 2025 at 06:30 PM UTC
Fixed (6.8.0)
Unknown
Unknown
Fixed (7.1.1)
Unknown
Unknown
Last Modified
10 months ago
December 03, 2025 at 02:28 PM UTC