What’s Vulnerable › Vulnerabilities

CVE-2004-0276

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2004-11-23 · updated 2026-06-16
• Weakness: CWE-20

Description

The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field.

Affected products

• monkey: through 0.8.1; 0.1.1, 0.5.2, 0.6.0, 0.6.1, 0.6.2, 0.6.3 (+4)

References

• http://aluigi.altervista.org/poc/monkeydos.zip
• http://marc.info/?l=bugtraq&m=107652610506968&w=2
• http://monkeyd.sourceforge.net/
• http://www.osvdb.org/3921
• http://www.securityfocus.com/bid/9642
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15187
• http://aluigi.altervista.org/poc/monkeydos.zip
• http://marc.info/?l=bugtraq&m=107652610506968&w=2
• http://monkeyd.sourceforge.net/
• http://www.osvdb.org/3921
• http://www.securityfocus.com/bid/9642
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15187

Get alerted when CVE-2004-0276 or the next vulnerability affects your stack