Re: [ANN] CVE-2025-64775: Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - S2-068

Lukasz Lenart <[email protected]> Sat, 6 Dec 2025 09:59:17 +0100

Newsgroups	gmane.comp.jakarta.struts.user
Message-ID	<CAMopvkNLhDc+xv67SXHaXXzu+C90xXOTjfmnzd-un3vsdWeR_A@mail.gmail.com>

pt., 5 gru 2025 o 18:25 Ggg Nnn <[email protected]> napisa=C5=82(a):
> Are Struts 6.x client applications vulnerable in case they do not rely
> on file uploads feature and they have explicitly disabled file upload
> support via struts.multipart.enabled config property (as explained in
> https://struts.apache.org/core-developers/action-file-upload#disabling-fi=
le-upload-support)?

No, if file upload support is disabled, your application is not
vulnerable. I updated the bulletin.

Cheers
=C5=81ukasz