Apache Struts Release Notes

Bug Fixes

This release patches the following:

• Apache Struts 2 is Missing XML Validation (CVE-2025-68493)
  • org.apache.struts:struts2-core:2.5.33-struts2-2.5.39

Bug Fixes

This release patches the following:

• Vulnerable to DoS via File Leak (CVE-2025-64775 and CVE-2025-66675).
  • org.apache.struts:struts2-core:2.5.33-struts2-2.5.38

Dependency Upgrades

• commons-fileupload:commons-fileupload 1.4 -> 1.6.0
  • CVE-2023-24998 FileUpload denial of service vulnerability
    • Added configuration: struts.multipart.maxFiles (default 256) - The maximum number of files allowed in a multipart request
    • Added configuration: struts.multipart.maxFileSize (default 2097152) - The maximum size per file in a multipart request
  • CVE-2025-48976 FileUpload DoS via part headers
    • Added configuration: struts.multipart.partHeaderSizeMax (default 512) - The maximum size of headers per part in a multipart request in bytes
• commons-io:commons-io 2.6 -> 2.19.0
  • CVE-2021-29425 Path Traversal and Improper Input Validation in Apache Commons IO
  • CVE-2024-47554 Possible denial of service attack on untrusted input to XmlStreamReader
• commons-beanutils:commons-beanutils 1.9.4 -> 1.11.0
  • CVE-2025-48734 Improper Access Control vulnerability

Bug Fixes

This release patches the following:

• File upload logic is flawed, and allows an attacker to enable paths with traversals (CVE-2024-53677).
  • com.herodevs.nes.apache.struts.struts2-core:2.5.33-struts2-2.5.35