CVE-2000-0258

High CVSS 7.5

Published 2000-04-12 · last changed 2026-06-16

The fix

We hold no Microsoft remediation data for CVE-2000-0258, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

IIS 4.0 and 5.0 allows remote attackers to cause a denial of service by sending many URLs with a large number of escaped characters, aka the "Myriad Escaped Characters" Vulnerability.

Sources

NVD record for CVE-2000-0258

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H