CVE-2008-3257: Bea WebLogic Server

High severity, CVSS 10.0. EPSS: 83.6% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.

Affected products

• Bea WebLogic Server: version 3.1.8 only; version 4.0 only; version 4.0.4 only; version 4.5 only; version 4.5.1 only; version 4.5.2 only; …
• Bea Systems Apache Connector In WebLogic Server: any version
• Bea Systems WebLogic Server: version 10.0_mp1 only
• Oracle WebLogic Server: up to and including 10.3

Published 2008-07-22. Last modified 2026-06-16.