CVE-2006-6276 json
HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or…
published 2006-12-04 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6259
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.6%
- EPSS 3.6% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.
Patch / fix
Exploit prediction
3.65% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-102733-1
vendor-advisory, broken-link, patch
-
securityfocus.com
/bid/21371
vdb-entry, broken-link, patch, third-party-advisory
-
secunia.com
/advisories/23186
third-party-advisory, broken-link
-
securitytracker.com
/id?1017324
vdb-entry, broken-link, third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/30662
vdb-entry, third-party-advisory
-
vupen.com
/english/advisories/2006/4793
vdb-entry, broken-link
-
securitytracker.com
/id?1017323
vdb-entry, broken-link, third-party-advisory
-
securitytracker.com
/id?1017322
vdb-entry, broken-link, third-party-advisory
Sources
- CVE List CVE-2006-6276
- NVD CVE-2006-6276
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.