A critical denial of service vulnerability in Apache Struts allows unauthenticated attackers to crash systems through disk exhaustion.

This vulnerability is categorized as CWE-459 (Incomplete Cleanup), where the application fails to properly delete temporary files created during multipart HTTP request processing. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) confirms that this flaw is remotely exploitable by an unauthenticated attacker without user interaction.

The ability for an unauthenticated attacker to trigger disk exhaustion poses a significant risk to service availability. Successful exploitation can lead to system-wide instability or complete service outages, resulting in operational downtime and potential loss of data integrity for dependent applications. With a CVSS score of 8.2, this vulnerability is classified as High severity and requires immediate attention to prevent disruption of business-critical services.

Immediate Action: Upgrade to Apache Struts version 6.8.0 or 7.1.1, which contain the necessary fixes for the file cleanup issue.

Proactive Monitoring: Monitor server disk usage metrics and review application access logs for unusually high volumes of multipart requests or repeated request failures that may indicate an ongoing denial of service attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and filter suspicious multipart requests or limit the rate of requests from individual IP addresses to mitigate the impact of potential exploitation.

Public Exploit Available: Unknown

Given the ease with which this vulnerability can be exploited and the potential for severe service disruption, organizations should prioritize patching their Apache Struts deployments immediately. Administrators must transition to the recommended versions, 6.8.0 or 7.1.1, to ensure the multipart processing logic is correctly secured against disk exhaustion attacks.