The bug is said to be wormable and was found in the HTTP Protocol Stack.