CVE-2003-0225: Microsoft Internet Information Server

Medium severity, CVSS 5.0. EPSS: 38.5% chance of exploitation in the next 30 days.

The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.

Affected products

• Microsoft Internet Information Server: version 4.0 only
• Microsoft Internet Information Services: version 5.0 only

Published 2003-06-09. Last modified 2026-06-16.