CVE-2004-1120

Multiple buffer overflows in (1) http.c, (2) http-retr.c, (3) main.c and other code that handles...

10.0 HighPublic exploitFix available

Multiple buffer overflows in (1) http.c, (2) http-retr.c, (3) main.c and other code that handles network protocols in ProZilla 1.3.6-r2 and earlier allow remote servers to execute arbitrary code via a long Location header.

Exploit likelihood

14.6%Up 5.6 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Record: CVE-2004-1120
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-1120
Updated: 2026-11-02

EUVDEUVD-2004-1118 No score

Record: EUVD-2004-1118
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m36j-gvqp-gm68 No score

Multiple buffer overflows in (1) http.c, (2) http-retr.c, (3) main.c and other code that handles...

Record: GHSA-m36j-gvqp-gm68
Updated: 2026-11-02

Affected products

prozilla download accelerator

Affected packages

Affected packages
Package	Affected	Fixed
`prozilla` Debian:3.0	before 1:1.3.6-3woody3, plus listed versions 1:1.3.6-31:1.3.6-3woody11:1.3.6-3woody2	1:1.3.6-3woody3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Prozilla 1.3.6 - Remote Stack Overflow	2004-11-23

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-1120 is a high vulnerability (CVSS 10.0) in Prozilla Download Accelerator, published December 1, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.6%, the 96th percentile. Fixed in prozilla 1:1.3.6-3woody3.