CVE-2006-0420 json
BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding…
published 2006-01-25 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0427
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
BEA WebLogic Server and WebLogic Express 8.1 through SP4 and 7.0 through SP6 does not properly handle when servlets use relative forwarding, which allows remote attackers to cause a denial of service (slowdown) via unknown attack vectors that cause "looping stack overflow errors."
Patch / fix
- securitytracker.com/id?1015528 patch
- dev2dev.bea.com/pub/advisory/164 advisory
Exploit prediction
1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
References
-
dev2dev.bea.com
/pub/advisory/164
vendor-advisory, patch
-
securitytracker.com
/id?1015528
vdb-entry, patch
Sources
- CVE List CVE-2006-0420
- NVD CVE-2006-0420
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.