CVE-2007-0087 in the critical feed json
Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to…
published 2007-01-05 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0091
- cvss
- 7.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 24.4%
- EPSS 24.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal
Exploit prediction
24.40% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.8 | AV:N/AC:L/Au:N/C:N/I:N/A:C |
References
-
securityfocus.com
/archive/1/455920/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/455879/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/455833/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/455882/100/0/threaded
mailing-list
-
osvdb.org
/33457
vdb-entry
Sources
- CVE List CVE-2007-0087
- NVD CVE-2007-0087
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.