CVE-2006-1546

highpriority · track · 32EPSS 0.063 · 94 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

6.29% (94th) EPSS

CVSS 7.5 · high

Is it mine?

5 products

Check your exposure

Who says so?

4 sources

enisa_euvd · nvd · osv · redhat_csaf

EPSS · scored 2026-10-27

Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRed Hat Application Server 3ASredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
https://access.redhat.com/errata/RHSA-2006:0281
FixedRed Hat Application Server v2 4ASredhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
https://access.redhat.com/errata/RHSA-2006:0281

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7.5

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:P/A:P/E:Usecondary · CVSS-BT (t0sche)

v3.17.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Lsecondary · OSV

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20US

affected products (5)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
apache struts≤ 1.2.8nvdUScpe:2.3:a:apache:struts:*:*:*:*:*:*:*:*
Maven struts:struts< 1.2.9osvUSpkg:maven/struts/struts
Red Hat Application Server 3ASall versionsfixedredhat_csafUScpe:/a:redhat:rhel_application_server:1
Red Hat Application Server v2 4ASall versionsfixedredhat_csafUScpe:/a:redhat:rhel_application_server:2

advisories (2)

Vendor and ecosystem advisories describing this.

RHSA-2006:0281Red Hat Security Advisory: struts security update for Red Hat Application Server2006-05-03csaf · redhat_csafUS
An updated Struts package that fixes several security issues is now available for Red Hat Application Server. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
GHSA-vf8g-mpmw-qv87Apache Struts vulnerable to Improper Input Validation2022-05-01ghsa · osvUS
Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd nvd osv redhat_csaf NVD CVE.org MITRE

published 2006-03-30modified 2026-06-16

references (22)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan