{"schemaVersion":3,"id":"CVE-2006-6276","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.","dates":{"published":"2006-12-04T11:00:00.000Z","modified":"2024-08-07T20:19:35.091Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03637,"percentile":0.89424,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.03637},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03637,"percentile":0.89424}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03637,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03637,"percentile":0.89424}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"The product acts as an intermediary HTTP agent\n         (such as a proxy or firewall) in the data flow between two\n         entities such as a client and server, but it does not\n         interpret malformed HTTP requests or responses in ways that\n         are consistent with how the messages will be processed by\n         those entities that are at the ultimate destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/444.html"}],"affected":[{"vendor":"sun","product":"java_system_application_server","name":"java system application server","label":"java_system_application_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 8.1","eol":null,"hubHref":"/vendor/sun/java_system_application_server"},{"vendor":"sun","product":"java_system_web_proxy_server","name":"java system web proxy server","label":"java_system_web_proxy_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null},{"text":"3.6","noFixRecorded":false,"fixedIn":null},{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"na | 3.6 | 4.0","eol":null,"hubHref":"/vendor/sun/java_system_web_proxy_server"},{"vendor":"sun","product":"java_system_web_server","name":"java system web server","label":"java_system_web_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"6.0","noFixRecorded":false,"fixedIn":null},{"text":"6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.0 | 6.1","eol":null,"hubHref":"/vendor/sun/java_system_web_server"},{"vendor":"sun","product":"one_application_server","name":"one application server","label":"one_application_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0","eol":null,"hubHref":"/vendor/sun/one_application_server"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1","label":"sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1","hostname":"sunsolve.sun.com","tags":["Vendor Advisory","X Refsource SUNALERT","Broken Link","Patch"]},{"url":"http://secunia.com/advisories/23186","label":"secunia.com/advisories/23186","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://securitytracker.com/id?1017324","label":"securitytracker.com/id?1017324","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30662","label":"exchange.xforce.ibmcloud.com/vulnerabilities/30662","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/4793","label":"www.vupen.com/english/advisories/2006/4793","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"http://www.securityfocus.com/bid/21371","label":"www.securityfocus.com/bid/21371","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Patch","Third Party Advisory"]},{"url":"http://securitytracker.com/id?1017323","label":"securitytracker.com/id?1017323","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://securitytracker.com/id?1017322","label":"securitytracker.com/id?1017322","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2006-12-04T11:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T20:19:35.091Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:53:44.803Z","stale":false,"partial":false}}