CVE-2006-1547: Improper Input Validation in Apache Struts
Summary
CVE-2006-1547: Improper Input Validation in Apache Struts. Affects struts:struts versions < 1.2.9. Fixed in 1.2.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Struts is an open-source framework for developing Java web applications. It provides a Model-View-Controller (MVC) architecture and various features to simplify web application development. The vulnerability in Apache Struts before version 1.2.9 with BeanUtils 1.7 arises from improper input validation in the ActionForm component. This vulnerability allows remote attackers to cause a denial of service (DoS) by exploiting a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method. This method provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Vulnerability Detail
The vulnerability in Apache Struts allows remote attackers to exploit a DoS vulnerability by sending a specially crafted multipart/form-data encoded form. By referencing the public getMultipartRequestHandler method, the attacker gains access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils. This can lead to a DoS attack, potentially impacting the availability of the affected web application. The vulnerability has a CVSS v3 score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 1.2.9 as of 23 Oct 2026
The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache Struts version 1.2.9 or later.
Conclusion
The vulnerability in Apache Struts before version 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service (DoS) by exploiting improper input validation in the ActionForm component. To mitigate this vulnerability, it is crucial to upgrade to Apache Struts version 1.2.9 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for struts:struts →
FAQ
Apache Struts is an open-source framework for developing Java web applications. It provides a Model-View-Controller (MVC) architecture and various features to simplify web application development.
The vulnerability allows remote attackers to cause a denial of service (DoS) by exploiting a multipart/form-data encoded form. This can potentially impact the availability of the affected web application.
To fix this vulnerability, it is recommended to upgrade to Apache Struts version 1.2.9 or later. Updating the Apache Struts dependency in the project's Maven pom.xml file to version 1.2.9 or later should resolve the vulnerability.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache Struts version 1.2.9 or later.
The CVSS v3 score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for struts:struts.
