What is the CVSS score of CVE-2025-64775?

CVE-2025-64775 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ubuntu are affected by CVE-2025-64775?

Apache Struts installations are vulnerable to a denial-of-service attack that exploits multipart request processing to exhaust disk space, potentially rendering affected applications unavailable.. A patch is available.

Is there a public PoC exploit available for CVE-2025-64775?

Yes, a public proof-of-concept exploit is available for CVE-2025-64775. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-64775?

Within 24 hours: Inventory all Struts deployments and affected versions; assess exposure by identifying internet-facing or file-upload-enabled instances. Within 7 days: Implement compensating controls (WAF rules blocking oversized multipart requests, disable multipart uploads if not essential, enable disk usage monitoring/alerts). Within 30 days: Upgrade to Struts 6.8.0 or 7.1.1; validate patches in staging before production deployment.

Ubuntu CVE-2025-64775

EUVD-2025-200019 HIGH

Incomplete Cleanup (CWE-459)

2025-12-01 security@apache.org

GHSA-xx7v-hqxh-cjr9

Denial Of Service Apache Debian Ubuntu Red Hat Struts

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-200019

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Jan 26, 2026 - 11:30 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 16:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

49 maven packages depend on org.apache.struts:struts2-core (43 direct, 6 indirect)

Ecosystem-wide dependent count for version 6.0.0.

DescriptionNVD

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Analysis

Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.

This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3.

Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Incomplete Cleanup (CWE-459).

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More from same product – last 7 days

CVE-2025-48977 HIGH This Week

8.5 May 28

Path traversal in Apache Ignite 2.0.0 through 2.17.0 lets authenticated REST API users read arbitrary files on the serve

CVE-2026-9277 HIGH This Week

8.1 May 22

Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr

CVE-2026-9256 HIGH This Week

8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

CVE-2026-47269 HIGH This Week

7.4 May 27

Authentication-context bypass in pam_usb before 0.9.0 lets a person holding an enrolled USB device authenticate over SSH

CVE-2026-42782 HIGH This Week

7.2 May 25

Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig

Vendor StatusVendor

Ubuntu

Priority: Medium

Debian

libstruts1.2-java

Release	Status	Fixed Version	Urgency
(unstable)	fixed	(unfixed)	-

CVE-2025-64775 vulnerability details – vuln.today

Back

Ubuntu CVE-2025-64775

CVSS VectorNVD

Lifecycle Timeline

Blast Radius

DescriptionNVD

Analysis

Technical ContextAI

RemediationAI

More from same product – last 7 days

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code