CVE-2008-2240: IBM Lotus Domino Web Server Accept-Language stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe vulnerability is remotely reachable without authentication and rated CVSS 10, with high EPSS, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

The IBM Lotus Domino Web Server service contains a stack-based buffer overflow reachable through an overly long Accept-Language HTTP header. A remote, unauthenticated attacker can crash the daemon or potentially execute arbitrary code on the server. The flaw affects Domino before 7.0.3 FP1 and 8.x before 8.0.1.

Impact

An attacker can cause a denial of service by crashing the Domino daemon, and the overflow may allow arbitrary code execution in the context of the Web Server service.

Attack surface

Reached over the network via an HTTP request to the Domino Web Server with a crafted Accept-Language header; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is high at roughly 0.648 (99.2nd percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade to Lotus Domino 7.0.3 FP1 or 8.0.1 (or later) as directed by IBM advisory swg21303057.
• If immediate patching is not possible, restrict network access to the Domino Web Server to trusted clients and place it behind a filtering reverse proxy.
• Deploy a WAF or HTTP inspection rule that rejects or truncates abnormally long Accept-Language headers.
• Monitor IBM advisories and apply subsequent Domino fix packs that include this correction.

Detection

• Inspect HTTP request logs for unusually long Accept-Language header values directed at the Domino Web Server.
• Alert on Domino Web Server process crashes or unexpected restarts correlated with inbound HTTP traffic.
• Use network IDS signatures for oversized Accept-Language headers against Domino endpoints.
• Review host logs for abnormal child processes or code execution spawned by the Domino Web Server service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.