Stack-based buffer overflow in POP Peeper 3.4.0.0 and earlier allows remote POP3 servers to execute arbitrary code via a long Date header,…

1. 2009-02-27 First public exploit (Metasploit exploit/windows/misc/poppeeper_date)
2. 2009-03-20 Published

31.84% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• Metasploit exploit/windows/misc/poppeeper_date POP Peeper v3.4 DATE Buffer Overflow metasploit exploit, normal rank, 2009-02-27
• Metasploit exploit/windows/misc/poppeeper_uidl POP Peeper v3.4 UIDL Buffer Overflow metasploit exploit, normal rank, 2009-02-27
• EDB-16458 POP Peeper 3.4 - UIDL Buffer Overflow (Metasploit) remote, 2010-11-30
• EDB-16441 POP Peeper 3.4 - DATE Buffer Overflow (Metasploit) remote, 2010-11-11
• EDB-8203 POP Peeper 3.4.0.0 - Date Remote Buffer Overflow remote, 2009-03-12

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

• exploit-db.com /exploits/8203

  exploit

• secunia.com /advisories/34077

  third-party-advisory, vendor-advisory

• securityfocus.com /bid/34093

  vdb-entry

• krakowlabs.com /res/adv/KL0309ADV-poppeeper_date-bof.txt
• securityfocus.com /archive/1/501701/100/0/threaded

  mailing-list

• exchange.xforce.ibmcloud.com /vulnerabilities/49215

  vdb-entry

• CVE List CVE-2009-1029
• NVD CVE-2009-1029

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.