CVE-2002-2268: Webster HTTP Server buffer overflow via long URL

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with a CVSS 2.0 score of 9.4 and high EPSS probability, though no confirmed in-the-wild or KEV activity is documented.

What it is

Webster HTTP Server contains a memory buffer overflow (CWE-119) triggered by a long URL. A remote, unauthenticated attacker can send an oversized request to corrupt memory, and the flaw is severe because it can lead to arbitrary code execution on the server.

Impact

An attacker can execute arbitrary code with the privileges of the Webster HTTP Server process, giving full control over confidentiality and integrity of the host. Availability is not indicated as affected by the CVSS vector.

Attack surface

Reachable over the network through the HTTP service by sending a crafted long URL; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

No CISA KEV listing and no ransomware association, but EPSS is 0.517 (98.9th percentile) and a public exploit reference is tagged, indicating meaningful real-world exploitation likelihood.

What to do

• Apply the vendor patch or upgrade Webster HTTP Server to a fixed release if one is available; the record does not name affected or fixed versions.
• If no patch exists, retire or replace the product, as it is a legacy 2002-era server.
• Restrict network access to the HTTP service with firewall rules or a reverse proxy that enforces URL length limits.
• Run the service under a low-privilege account and isolate it to limit post-exploitation impact.
• Monitor vendor and CVE sources for updated guidance since the record is thin on remediation detail.

Detection

• Inspect web server logs for abnormally long request URLs or request lines exceeding expected length.
• Alert on crashes, restarts or abnormal process termination of the Webster HTTP Server.
• Monitor for unexpected child processes or command execution spawned by the web server process.
• Use network IDS signatures for oversized HTTP request lines targeting this service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.