What is the CVSS score of CVE-2025-64775?

CVE-2025-64775 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-64775?

Apache Struts installations are vulnerable to a denial-of-service attack that exploits multipart request processing to exhaust disk space, potentially rendering affected applications unavailable.. A patch is available.

Is there a public PoC exploit available for CVE-2025-64775?

Yes, a public proof-of-concept exploit is available for CVE-2025-64775. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-64775?

Within 24 hours: Inventory all Struts deployments and affected versions; assess exposure by identifying internet-facing or file-upload-enabled instances. Within 7 days: Implement compensating controls (WAF rules blocking oversized multipart requests, disable multipart uploads if not essential, enable disk usage monitoring/alerts). Within 30 days: Upgrade to Struts 6.8.0 or 7.1.1; validate patches in staging before production deployment.

Ubuntu CVE-2025-64775

EUVD-2025-200019 HIGH

Incomplete Cleanup (CWE-459)

2025-12-01 security@apache.org

GHSA-xx7v-hqxh-cjr9

Denial Of Service Apache Ubuntu Debian Struts Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200019

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Jan 26, 2026 - 11:30 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

49 maven packages depend on org.apache.struts:struts2-core (43 direct, 6 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionCVE.org

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Analysis

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Incomplete Cleanup (CWE-459).