CVE-2004-0326: GateKeeper Pro web proxy buffer overflow via long GET request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with a network-reachable, unauthenticated buffer overflow that permits code execution, and EPSS is above the 99th percentile.

What it is

The web proxy in GateKeeper Pro 4.7 contains a buffer overflow that is triggered by a long GET request. A remote, unauthenticated attacker can send a crafted request to crash the proxy or execute arbitrary code in its context. The flaw matters because the proxy is internet-facing and the record gives no indication that any authentication or user interaction is required.

Impact

An attacker gains the ability to execute arbitrary code with the privileges of the proxy service, or at minimum to crash it. Because the proxy sits in the network path, compromise can expose or redirect traffic handled by that host.

Attack surface

Reached over the network through the web proxy's HTTP listener by sending an oversized GET request. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are needed.

Exploitation

No CISA KEV listing, but EPSS is 0.62809 (99th percentile) and a SecurityFocus reference is tagged Exploit, so public exploit material appears to exist. The record does not state whether exploitation has been observed in the wild.

What to do

• Apply the vendor fix for GateKeeper Pro 4.7 if one is available; the record does not name a patched version, so confirm with the vendor.
• If no fix exists, retire or isolate the product, since it is a long-obsolete proxy with a remotely reachable memory corruption flaw.
• Restrict access to the proxy listener to trusted networks and place it behind a filtering reverse proxy or WAF that caps request-line length.
• Run the proxy as a low-privilege account in a segmented network so code execution does not yield broad access.
• Monitor vendor and CVE channels for an updated advisory, as this record is marked Modified and may be revised.

Detection

• Alert on HTTP request lines exceeding normal length limits in proxy logs, especially unusually long GET requests.
• Watch for proxy process crashes, restarts, or core dumps correlated with inbound HTTP traffic.
• Monitor for unexpected child processes or outbound connections originating from the proxy host.
• Use network IDS signatures for oversized GET requests targeting the proxy port.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.