CVE-2007-0087

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-01-05 · updated 2026-06-16

Description

Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of service (network bandwidth consumption) via a Range header that specifies multiple copies of the same fragment. NOTE: the severity of this issue has been disputed by third parties, who state that the large window size required by the attack is not normally supported or configured by the server, or that a DDoS-style attack would accomplish the same goal

Affected products

Microsoft Internet Information Server: all versions

References

http://osvdb.org/33457
http://www.securityfocus.com/archive/1/455833/100/0/threaded
http://www.securityfocus.com/archive/1/455879/100/0/threaded
http://www.securityfocus.com/archive/1/455882/100/0/threaded
http://www.securityfocus.com/archive/1/455920/100/0/threaded
http://osvdb.org/33457
http://www.securityfocus.com/archive/1/455833/100/0/threaded
http://www.securityfocus.com/archive/1/455879/100/0/threaded
http://www.securityfocus.com/archive/1/455882/100/0/threaded
http://www.securityfocus.com/archive/1/455920/100/0/threaded

Get alerted when CVE-2007-0087 or the next vulnerability affects your stack