CVE-2006-1547VulnerabilityPublished 01/21/2022Updated 10/24/2026

CVE-2006-1547: Apache Struts 1 ActionForm Denial-of-Service Vulnerability

Affects Apache Struts 1Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/21/2022
KEV deadline: 07/21/2022
EPSS: 54.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2006-1547 (opens in a new tab)

Affected software

Product	Affected	Fixed in
Apache Struts 1	Affected <1.2.9	Fixed in–

Description

Apache Struts 1 versions before 1.2.9 that use BeanUtils 1.7 contain a vulnerability in ActionForm that allows denial-of-service (DoS) attacks. This vulnerability has been exploited in the wild. No explicit patch information is provided in the input data.

Summary

The vulnerability identified as CVE-2006-1547 affects Apache Struts 1 ActionForm components in versions prior to 1.2.9 when used with BeanUtils 1.7. It allows an attacker to cause a denial-of-service condition. The input data confirms exploitation in the wild but does not provide detailed technical exploitation methods or patch status.

Impact

Successful exploitation results in denial-of-service, potentially disrupting applications using affected versions of Apache Struts 1. This can lead to service unavailability.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify if updates or patches are available for Apache Struts 1 to address this issue. Until confirmed, consider mitigating exposure by limiting access or applying workarounds if documented by the vendor.

What to do

Affected software

Description

AnalysisAI-generated, updated 10/24/2026, 10:10:27 UTC

References

Related threats