CVEs / CVE-2006-1547

CVE-2006-1547: Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Known exploited in the CISA KEV catalog since 21 Jan 2022
high 7.5 CVSS 3.1 (NVD)
EPSS 54.6% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 16 Jun 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2006-1547

Summary

ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).
CISA, Known Exploited Vulnerabilities catalog

Description

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
The CVE record, via NVD · published 30 Mar 2006 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a n/a	n/a	—

Exploitation

In CISA KEV since	21 Jan 2022
Due date for US federal agencies	21 Jul 2022
Used in ransomware campaigns	Unknown
Required action	Apply updates per vendor instructions.

Severity

CVSS 3.1	7.5 high `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` Scored by NVD
Weakness	CWE-749

References

CVE-2006-1547 on NVD
CVE-2006-1547 in the CISA KEV catalog
http://issues.apache.org/bugzilla/show_bug.cgi?id=38534 Issue Tracking, Permissions Required
http://lists.suse.com/archive/suse-security-announce/2006-May/0004.html Broken Link
http://secunia.com/advisories/19493 Broken Link
http://secunia.com/advisories/20117 Broken Link
http://securitytracker.com/id?1015856 Broken Link, Third Party Advisory, VDB Entry
http://struts.apache.org/struts-doc-1.2.9/userGuide/release-notes.html Broken Link, Exploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/17342 Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2006/1205 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/25613 Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-1547 US Government Resource

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.