CVE-1999-1035

Medium

Published: 31/12/1999(UTC)Updated: 16/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

14.36%

96th percentile - higher than 96% of all known CVEs

Summary

IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, known as the IIS 'GET' vulnerability.

Risk Assessment

Attackers can exploit this vulnerability to disrupt server operations, potentially leading to service downtime for users.

Recommendation

It is recommended to upgrade to a newer version of IIS that is not vulnerable to this flaw and to monitor server logs for suspicious requests.

Original NVD description (English source)

IIS 3.0 and 4.0 on x86 and Alpha allows remote attackers to cause a denial of service (hang) via a malformed GET request, aka the IIS "GET" vulnerability.