CVE-2004-1561: Icecast HTTP header buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with public exploit code and very high EPSS, though no KEV listing or confirmed active campaigns are recorded.

What it is

Icecast 2.0.1 and earlier contains a buffer overflow triggered by an HTTP request carrying a large number of headers. Because the flaw is reachable over the network without authentication, it exposes any listening Icecast server to remote compromise. The record does not specify the exact overflowed buffer or the header count required.

Impact

A remote attacker can execute arbitrary code in the context of the Icecast service, potentially taking full control of the streaming host. The CVSS 2.0 vector rates confidentiality, integrity and availability impact as partial.

Attack surface

Reached over the network by sending a crafted HTTP request to the Icecast listener; the vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing Icecast 2.0.1 or earlier is in scope.

Exploitation

Public exploit code is referenced (Exploit tags on the aluigi, securiteam and SecurityFocus entries), and EPSS is 0.779 with a 0.995 percentile, indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade Icecast to a version later than 2.0.1; the Secunia and SecurityFocus references carry Patch tags, so apply the vendor fix first.
• If upgrade is not immediately possible, restrict network access to the Icecast listener with firewall rules or a reverse proxy that limits request header count and size.
• Run the Icecast service as an unprivileged, isolated account and confine it with OS-level sandboxing to limit post-exploitation reach.
• Monitor vendor advisories for this product line, since the record is old and the NVD status is Modified.

Detection

• Alert on HTTP requests to Icecast with an abnormally high number of headers or unusually large header blocks.
• Watch for Icecast process crashes or restarts, which may indicate overflow attempts.
• Monitor for unexpected child processes or outbound connections originating from the Icecast service account.
• Review Icecast access logs for repeated malformed or oversized requests from single sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.