VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2003· Updated Jun 16, 2026

CVE-2003-1318

CVE-2003-1318

Description

Twilight Webserver 1.3.3.0 allows remote attackers to cause a denial of service (application crash) via a GET request for a long URI, a different vulnerability than CVE-2004-2376.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1

Patches

Vulnerability mechanics

Root cause

"Missing input validation on URI length allows a buffer overflow when processing an overly long GET request."

Attack vector

An unauthenticated remote attacker sends a crafted HTTP GET request with an overly long URI (approximately 1037 bytes) to the Twilight WebServer on the target port [ref_id=1]. The server fails to properly validate the length of the incoming URI, causing a buffer overflow that results in a segmentation fault and crashes the application [ref_id=1]. The attack can be repeated in a loop to ensure the server remains unavailable.

Affected code

The advisory does not specify the exact function or file within Twilight WebServer v1.3.3.0 that contains the flaw. The crash is triggered by sending a long URI in a GET request, and the exploit code sends a buffer of 1037 bytes filled with 'A' characters as the URI path [ref_id=1].

What the fix does

The advisory states that the vendor released version 1.3.4.0 as the fixed version, but no patch diff or specific code change is provided [ref_id=1]. The remediation guidance is to upgrade to Twilight WebServer v1.3.4.0, which presumably adds proper bounds checking on the URI length before processing the request [ref_id=1].

Preconditions

  • configThe target must be running Twilight WebServer v1.3.3.0
  • networkThe attacker must be able to reach the server over the network on the listening port
  • authNo authentication is required

Reproduction

Compile the proof-of-concept exploit `twilight.c` provided in the advisory with `gcc twilight.c -o twilight` [ref_id=1]. Run `./twilight

Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.