CVE-2006-6276

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-04 · updated 2026-06-16
Weakness: CWE-444

Description

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.

Affected products

Sun Java System Application Server: 7.0, 8.1
Sun Java System Web Proxy Server: 3.6, 4.0
Sun Java System Web Server: 6.0, 6.1
Sun One Application Server: 7.0

References

http://secunia.com/advisories/23186
http://securitytracker.com/id?1017322
http://securitytracker.com/id?1017323
http://securitytracker.com/id?1017324
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1
http://www.securityfocus.com/bid/21371
http://www.vupen.com/english/advisories/2006/4793
https://exchange.xforce.ibmcloud.com/vulnerabilities/30662
http://secunia.com/advisories/23186
http://securitytracker.com/id?1017322
http://securitytracker.com/id?1017323
http://securitytracker.com/id?1017324

Get alerted when CVE-2006-6276 or the next vulnerability affects your stack