CVE-2006-6276

HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors.

Published: 2006-12-04 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2006-6276 is rated Moderate Risk (54.5/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.19%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2006-6276

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-07-23 1.14% 1.19% +0.05%
2 2025-03-30 0.73% 1.14% +0.41%
3 2025-03-29 — 0.73% —

Full EPSS history (15 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2006-6276

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.8 2.0 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 6.4 [email protected]

Weakness enumeration for CVE-2006-6276

OS Trackers for CVE-2006-6276

vendor priority summary link
alpine — CVE-2006-6276: no source package rows; 0 state rows across 0 repos (none); fixed 0, open 0. https://security.alpinelinux.org/vuln/CVE-2006-6276

Affected software / configurations for CVE-2006-6276

Vendor Product Version Raw CPE
sun java_system_application_server 7.0 cpe:2.3:a:sun:java_system_application_server:7.0:*:*:*:*:*:*:*
sun java_system_application_server 8.1 cpe:2.3:a:sun:java_system_application_server:8.1:*:*:*:*:*:*:*
sun java_system_web_proxy_server — cpe:2.3:a:sun:java_system_web_proxy_server:-:*:*:*:*:*:*:*
sun java_system_web_proxy_server 3.6 cpe:2.3:a:sun:java_system_web_proxy_server:3.6:*:*:*:*:*:*:*
sun java_system_web_proxy_server 4.0 cpe:2.3:a:sun:java_system_web_proxy_server:4.0:*:*:*:*:*:*:*
sun java_system_web_server 6.0 cpe:2.3:a:sun:java_system_web_server:6.0:*:*:*:*:*:*:*
sun java_system_web_server 6.1 cpe:2.3:a:sun:java_system_web_server:6.1:*:*:*:*:*:*:*
sun one_application_server 7.0 cpe:2.3:a:sun:one_application_server:7.0:*:*:*:*:*:*:*

References for CVE-2006-6276

URL Tags
http://secunia.com/advisories/23186 Broken Link
http://securitytracker.com/id?1017322 Broken Link Third Party Advisory VDB Entry
http://securitytracker.com/id?1017323 Broken Link Third Party Advisory VDB Entry
http://securitytracker.com/id?1017324 Broken Link Third Party Advisory VDB Entry
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102733-1 Broken Link Patch
http://www.securityfocus.com/bid/21371 Broken Link Patch Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2006/4793 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/30662 Third Party Advisory VDB Entry
cvelogic Threat Intelligence