Live › vulnerability › CVE-2006-1547
Go to dashboardApache Struts 1 ActionForm handling, when combined with BeanUtils 1.7, lets a remote request make the application unavailable. The CISA KEV entry says it is being exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Struts 1 | vendor | – | – |
Check the Struts 1 version in the application's WEB-INF/lib for struts.jar and the BeanUtils version for commons-beanutils.jar; unknown whether a single command is documented in the sources.
Upgrade Apache Struts 1 to 1.2.9 or later, and use a BeanUtils version other than 1.7 per vendor instructions.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
This page as .md · .json · in your agent: get_signal("CVE-2006-1547")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.