CVE-2010-0361: Sun Java System Web Server WebDAV stack buffer overflow via long URI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityMaximum CVSS v2 score, unauthenticated remote reachability, public exploit references, and very high EPSS probability make this a top remediation priority.

What it is

Sun Java System Web Server 7.0 Update 7 contains a stack-based buffer overflow in the WebDAV implementation of webservd. A remote attacker can send an HTTP OPTIONS request with an overly long URI to crash the daemon and possibly achieve other unspecified impact. The flaw is remotely reachable without authentication and carries a maximum CVSS v2 score.

Impact

An attacker can cause a denial of service by crashing the webservd daemon; the record also notes possible unspecified other impact, which could include code execution, but this is not confirmed in the description.

Attack surface

Reachable over the network through the WebDAV HTTP interface by sending a crafted OPTIONS request with a long URI. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/Au:N).

Exploitation

No CISA KEV listing, but EPSS is 0.80521 (99.6th percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor patch or upgrade Sun Java System Web Server beyond 7.0 Update 7.
• Disable WebDAV if it is not required for business operations.
• Restrict network access to the WebDAV service using firewall rules or reverse proxy filtering.
• Enforce URI length limits at the reverse proxy or web server layer to block oversized requests.
• Monitor for and block malformed OPTIONS requests with abnormally long URIs.

Detection

• Inspect web server and proxy logs for HTTP OPTIONS requests with unusually long URIs.
• Alert on webservd crashes or unexpected restarts correlated with WebDAV traffic.
• Use network IDS signatures for oversized OPTIONS request URIs targeting WebDAV endpoints.
• Baseline normal URI lengths and flag outliers in WebDAV request paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.