UpHeron
All vulnerabilities

Servers and applications

CVE-2006-1547

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 21 Jan 2022.

Severity
High 7.5
Published
30 Mar 2006
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.2.9
Exploit chance
55% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
CWE-749
Attack
Over the network · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
NVD

Affected software

SoftwareAffected versions
Apache StrutsServers and applications · cpe:a:apache:struts
  • Every version before 1.2.9

Known exploited

CISA name
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
21 Jul 2022
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2006-1547
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2006-1547