IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host".
https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-1140
http://www.securityfocus.com/bid/5749