Fast Facts

• CVE-2025-64775 targets Apache Struts, a widely used web application framework.
• Attackers can fill servers’ hard drives, causing outages or severe slowdowns.
• Vulnerable versions include Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.7.0, and 7.0.0 through 7.0.3.
• No workaround exists; upgrading to Struts 6.8.0+ or 7.1.1+ is the only fix.
• Organizations running unsupported Struts versions face the highest risk.

The Digital Achilles’ Heel

Imagine a busy city where the garbage collectors suddenly go on strike. Trash piles up, streets become impassable, and daily life grinds to a halt. This is the scenario now facing thousands of businesses relying on Apache Struts, after a critical vulnerability-CVE-2025-64775-was uncovered. The flaw lets attackers flood web servers with junk data, quickly filling up hard drives and effectively shutting down entire websites or applications.

How the Attack Works

At the heart of the problem is how Apache Struts handles file uploads-known in technical terms as "multipart requests." Normally, when users upload photos or documents, temporary files are created and later deleted. But due to a programming oversight, these temporary files can linger, never being cleaned up. A malicious actor can exploit this by repeatedly sending large, fake uploads, filling the disk until the system can’t breathe. When a server’s storage is maxed out, it can’t save new data or logs, leading to slowdowns, crashes, or total unavailability-a textbook denial-of-service (DoS) scenario.

A Familiar Echo: Past Lessons, Present Dangers

This isn’t the first time Apache Struts has made headlines for the wrong reasons. In 2017, a vulnerability in Struts led to the infamous Equifax data breach, exposing sensitive information of over 140 million people. While the current flaw doesn’t allow direct data theft, it’s a potent weapon for disruption. Security advisories from both the Apache Software Foundation and independent researchers like Nicolas Fournier emphasize the urgency: there’s no quick fix, no configuration tweak-only a full upgrade to patched versions will do.

Global Stakes and Market Fallout

Apache Struts powers everything from banking portals to government websites. A successful disk exhaustion attack could knock critical services offline, causing financial loss and reputational harm. The risk is especially acute for organizations still running old, unsupported Struts versions. With no further security patches for those legacy systems, they are sitting ducks for cybercriminals. The race is now on for IT teams worldwide to audit their infrastructure and patch up before attackers make their move.

WIKICROOK

• Apache Struts: Apache Struts is an open-source framework that streamlines the creation of Java web applications using the Model-View-Controller (MVC) design pattern.
• Denial: Denial in cybersecurity means making systems or services unavailable to users, often through attacks like Denial-of-Service (DoS) that flood them with traffic.
• Multipart Request: A multipart request is a web request format that allows multiple files or data types to be uploaded together via online forms.
• CVE (Common Vulnerabilities and Exposures): A CVE is a unique public identifier for a specific security vulnerability, enabling consistent tracking and discussion across the cybersecurity industry.
• End: End-to-end encryption is a security method where only the sender and recipient can read messages, keeping data private from service providers and hackers.