ZeroDay Findings
Sign inSign up

Findings

CVE-2006-1547

Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Published Mar 30, 2006 · updated Jun 16, 2026 · apache struts

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 30, 2006 · Catalog

    Detected

    ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

  2. Jan 21, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 21, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.

Required action

Apply updates per vendor instructions.

CISA due date Jul 21, 2022

Affected

  • cpe apache/strutsversion unspecified
  • vendor Apache Struts 1version unspecified

Sources

  • CISA KEVCVE-2006-1547

    ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).

    cisa.gov
  • CVE.orgCVE-2006-1547

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2006-1547

    30-day exploitation probability 54.6%

    first.org
  • NIST NVDCVE-2006-1547

    ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides fur

    nvd.nist.gov

References