CVE-2006-1547

Apache Struts 1 versions before 1.2.9, when used with BeanUtils 1.7, contain a denial-of-service vulnerability in how ActionForm beans are populated from request data. An attacker can send crafted HTTP request parameters that, when applied to an ActionForm via BeanUtils, consume excessive server resources and disrupt or crash the affected web application. The impact is availability only — no code execution or access — so an unauthenticated remote attacker gains the ability to degrade or take down the service. Any organization running legacy Java web applications built on Apache Struts 1 prior to 1.2.9 is affected. CISA added this flaw to its Known Exploited Vulnerabilities Catalog on 2022-01-21, confirming in-the-wild exploitation; no public proof-of-concept is known, and any ransomware association is not reported.

What to do: Upgrade Apache Struts 1 to version 1.2.9 or later as required by CISA's KEV catalog, and inventory deployed WAR/EAR files for bundled Struts 1 and BeanUtils 1.7 jars since the framework is end-of-life. For legacy applications that cannot be patched or migrated to a supported framework, restrict internet exposure or apply WAF/request-filtering controls to limit unauthenticated access to the vulnerable form-handling paths.