{"api_version":"1","generated_at":"2026-07-23T11:10:34+00:00","cve":"CVE-2006-6276","urls":{"html":"https://cve.report/CVE-2006-6276","api":"https://cve.report/api/cve/CVE-2006-6276.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-6276","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-6276"},"summary":{"title":"CVE-2006-6276","description":"HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-12-04 11:28:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-444","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://securitytracker.com/id?1017324","name":"http://securitytracker.com/id?1017324","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"SecurityTracker.com Archives - Sun Java System Web Proxy Server Lets Remote Users Conduct HTTP Request Smuggling Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/4793","name":"http://www.vupen.com/english/advisories/2006/4793","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1","name":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Patch"],"title":"#102733: Security Vulnerability With HTTP Requests in Sun Java System Server(s)","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://securitytracker.com/id?1017322","name":"http://securitytracker.com/id?1017322","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"SecurityTracker.com Archives - Sun Java Application Server Lets Remote Users Conduct HTTP Request Smuggling Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1017323","name":"http://securitytracker.com/id?1017323","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"SecurityTracker.com Archives - Sun Java System Web Server Lets Remote Users Conduct HTTP Request Smuggling Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/23186","name":"http://secunia.com/advisories/23186","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Sun Java System Server Products HTTP Request Smuggling - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30662","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30662","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/21371","name":"http://www.securityfocus.com/bid/21371","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Patch","Third Party Advisory","VDB Entry"],"title":"Sun Multiple Java System Request Smuggling Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-6276","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6276","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_application_server","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_application_server","cpe6":"8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_web_proxy_server","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_web_proxy_server","cpe6":"3.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_web_proxy_server","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_web_server","cpe6":"6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"java_system_web_server","cpe6":"6.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"6276","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sun","cpe5":"one_application_server","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T20:19:35.091Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"102733","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1"},{"name":"23186","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/23186"},{"name":"1017324","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1017324"},{"name":"sunserver-proxy-csrf(30662)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30662"},{"name":"ADV-2006-4793","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/4793"},{"name":"21371","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/21371"},{"name":"1017323","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1017323"},{"name":"1017322","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1017322"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-11-30T00:00:00.000Z","descriptions":[{"lang":"en","value":"HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"102733","tags":["vendor-advisory","x_refsource_SUNALERT"],"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1"},{"name":"23186","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/23186"},{"name":"1017324","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1017324"},{"name":"sunserver-proxy-csrf(30662)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30662"},{"name":"ADV-2006-4793","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/4793"},{"name":"21371","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/21371"},{"name":"1017323","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1017323"},{"name":"1017322","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1017322"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-6276","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"102733","refsource":"SUNALERT","url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1"},{"name":"23186","refsource":"SECUNIA","url":"http://secunia.com/advisories/23186"},{"name":"1017324","refsource":"SECTRACK","url":"http://securitytracker.com/id?1017324"},{"name":"sunserver-proxy-csrf(30662)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30662"},{"name":"ADV-2006-4793","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/4793"},{"name":"21371","refsource":"BID","url":"http://www.securityfocus.com/bid/21371"},{"name":"1017323","refsource":"SECTRACK","url":"http://securitytracker.com/id?1017323"},{"name":"1017322","refsource":"SECTRACK","url":"http://securitytracker.com/id?1017322"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-6276","datePublished":"2006-12-04T11:00:00.000Z","dateReserved":"2006-12-03T00:00:00.000Z","dateUpdated":"2024-08-07T20:19:35.091Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-12-04 11:28:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-444","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_application_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"EAB26B3D-4DF0-45C2-9ECA-202C829392D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_application_server:8.1:*:*:*:*:*:*:*","matchCriteriaId":"721D0068-2664-4E92-9D96-9007F2120450"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_web_proxy_server:-:*:*:*:*:*:*:*","matchCriteriaId":"9134A420-1A6E-48C0-A6CE-5AE555FC0D94"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_web_proxy_server:3.6:*:*:*:*:*:*:*","matchCriteriaId":"D36EE342-0A55-4F2E-9037-14C0975CEA9E"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_web_proxy_server:4.0:*:*:*:*:*:*:*","matchCriteriaId":"FB8D89B7-2C74-4CDC-8708-D9FACC4DE7C3"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_web_server:6.0:*:*:*:*:*:*:*","matchCriteriaId":"6E592549-5C28-4F0A-B407-06A33B3CFFF8"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:java_system_web_server:6.1:*:*:*:*:*:*:*","matchCriteriaId":"044D96F6-7A18-4295-A665-16F1A6630963"},{"vulnerable":true,"criteria":"cpe:2.3:a:sun:one_application_server:7.0:*:*:*:*:*:*:*","matchCriteriaId":"56BB3993-C089-421F-987E-D6294E8C909E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"6276","Ordinal":"1","Title":"CVE-2006-6276","CVE":"CVE-2006-6276","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"6276","Ordinal":"1","NoteData":"HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.","Type":"Description","Title":"CVE-2006-6276"},{"CveYear":"2006","CveId":"6276","Ordinal":"2","NoteData":"2006-12-04","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"6276","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}