CVE-2004-0313: PSOProxy HTTP request buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe CVSS 2.0 score is 10.0 with a network, unauthenticated vector and public exploit references, though the product is old and not in KEV.

What it is

PSOProxy 0.91 contains a buffer overflow triggered by a long HTTP request, specifically a long GET argument or method name. A remote, unauthenticated attacker can crash the service and possibly execute arbitrary code, making this a full-compromise risk for exposed instances.

Impact

An attacker can cause a denial of service and potentially execute arbitrary code with the privileges of the PSOProxy process, leading to full loss of confidentiality, integrity and availability on the host.

Attack surface

The flaw is reached over the network via HTTP requests to the PSOProxy service; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

CVE-2004-0313 is not listed in CISA KEV, but EPSS is high (0.636, 99th percentile) and SecurityFocus references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor fix or upgrade PSOProxy past 0.91; if no patch is available, retire or replace the product.
• Restrict network access to the PSOProxy listener with firewall rules or a reverse proxy that enforces request length limits.
• Run the service as an unprivileged, isolated account and confine it with sandboxing or a container.
• Monitor for and block oversized HTTP request lines and method names at the perimeter.
• If the service is not required, disable it entirely.

Detection

• Inspect HTTP server and proxy logs for abnormally long GET arguments or method names.
• Alert on PSOProxy process crashes or restarts correlated with inbound HTTP traffic.
• Use network IDS signatures for oversized HTTP request lines targeting the PSOProxy port.
• Monitor for unexpected child processes or outbound connections spawned by the PSOProxy process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.