Orenosv 0.5.9f allows remote attackers to cause a denial of service (crash) via a long HTTP GET request.

1. 2004-05-25 First public exploit (EDB-24145)
2. 2004-05-26 Published

3.95% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-24147 Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (3) dos, 2004-06-02
• EDB-24146 Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (2) dos, 2004-06-02
• EDB-24145 Orenosv HTTP/FTP Server 0.5.9 - GET Denial of Service (1) dos, 2004-05-25
• osvdb.org http://www.osvdb.org/6419 referenced PoC, tagged "exploit" by a source, unverified
• secunia.com http://secunia.com/advisories/11706 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/10420 referenced PoC, tagged "exploit" by a source, unverified
• hp.vector.co.jp http://hp.vector.co.jp/authors/VA027031/orenosv/index_en.html referenced PoC, tagged "exploit" by a source, unverified

• osvdb.org /6419

  vdb-entry, exploit, patch, vendor-advisory

• secunia.com /advisories/11706

  third-party-advisory, exploit, patch, vendor-advisory

• securityfocus.com /bid/10420

  vdb-entry, exploit, patch, vendor-advisory

• hp.vector.co.jp /authors/VA027031/orenosv/index_en.html

  exploit, vendor-advisory

• exchange.xforce.ibmcloud.com /vulnerabilities/16250

  vdb-entry

• marc.info /?l=bugtraq&m=108559623703422&w=2

  mailing-list

• CVE List CVE-2004-2033
• NVD CVE-2004-2033

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.