Vulnerability record · CVE-2006-1547 · published 30 March 2006
CVE-2006-1547: Apache Struts 1 ActionForm multipart parameter denial of service
Apache · Struts
Apache Struts before 1.2.9 with BeanUtils 1.7 exposes the public getMultipartRequestHandler method through ActionForm parameter binding. A remote attacker can send a multipart/form-data form whose parameter name references that method, reaching CommonsMultipartRequestHandler and BeanUtils internals. This causes a denial of service.
Description
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 7.5 with network reachability, no authentication, and KEV listing make this a high-priority denial-of-service risk despite the lack of confidentiality or integrity impact.
What it is
Apache Struts before 1.2.9 with BeanUtils 1.7 exposes the public getMultipartRequestHandler method through ActionForm parameter binding. A remote attacker can send a multipart/form-data form whose parameter name references that method, reaching CommonsMultipartRequestHandler and BeanUtils internals. This causes a denial of service.
Impact
An unauthenticated remote attacker can crash or exhaust the application, denying service to legitimate users. No data confidentiality or integrity impact is described.
Attack surface
Reachable over the network by sending a crafted multipart/form-data HTTP request to a Struts 1 ActionForm endpoint. No authentication or user interaction is required per the CVSS vector.
Exploitation
Listed in CISA KEV since 2022-01-21, indicating known exploitation, and EPSS 30-day probability is 0.54635 (98.9th percentile). A vendor release-notes reference is tagged Exploit and Patch.
What to do
- Upgrade Apache Struts to 1.2.9 or later, which addresses this issue.
- If immediate upgrade is not possible, restrict or disable multipart/form-data handling on affected ActionForm endpoints.
- Review BeanUtils parameter binding to block parameter names that reference internal handler methods such as getMultipartRequestHandler.
- Apply vendor or distribution updates for bundled Struts deployments.
Detection
- Inspect HTTP request logs for multipart/form-data submissions containing parameter names referencing getMultipartRequestHandler.
- Alert on repeated multipart requests to Struts ActionForm endpoints that coincide with application errors or restarts.
- Monitor for spikes in 5xx responses or process crashes on Struts 1 applications.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2006-1547 to the Known Exploited Vulnerabilities catalog on 21 January 2022 as "Apache Struts 1 ActionForm Denial-of-Service Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 21 July 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-1547 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-1547), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
