Buffer overflow in Webster HTTP Server allows remote attackers to execute arbitrary code via a long URL.

1. 2002-12-02 First public exploit (Metasploit exploit/windows/http/webster_http)
2. 2002-12-31 Published

51.75% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/http/kolibri_http Kolibri HTTP Server HEAD Buffer Overflow metasploit exploit, good rank, 2010-12-26
• Metasploit exploit/windows/http/webster_http Webster HTTP Server GET Buffer Overflow metasploit exploit, average rank, 2002-12-02
• EDB-16970 Kolibri HTTP Server 2.0 - HEAD Buffer Overflow (Metasploit) remote, 2011-08-03
• EDB-16802 Webster HTTP Server - GET Buffer Overflow (Metasploit) remote, 2010-11-03
• securiteam.com http://www.securiteam.com/windowsntfocus/6R0030A6AY.html referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

• securiteam.com /windowsntfocus/6R0030A6AY.html

  exploit

• seclists.org /lists/bugtraq/2002/Dec/0013.html

  mailing-list

• securityfocus.com /bid/6289

  vdb-entry

• exchange.xforce.ibmcloud.com /vulnerabilities/10727

  vdb-entry

• CVE List CVE-2002-2268
• NVD CVE-2002-2268

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.