Safeguard
Vulnerability Analysis•

SQL Slammer (2003): 376 Bytes That Saturated the Internet in Minutes

A factual retrospective on the January 2003 SQL Slammer worm, which exploited a patched buffer overflow in Microsoft SQL Server and doubled in size every 8.5 seconds, disrupting internet infrastructure globally.

Safeguard Research Team
2 min read

SQL Slammer (2003): 376 Bytes That Saturated the Internet in Minutes

Summary

SQL Slammer began spreading on January 25, 2003, and is widely cited as the fastest-spreading computer worm recorded. Analyses at the time found it doubled its infected population roughly every 8.5 seconds and infected the large majority of vulnerable hosts within about ten minutes. It caused widespread internet slowdowns, took down ATM networks, and disrupted airline check-in systems.

Technical Root Cause

Slammer exploited a stack buffer overflow (CWE-121) in the Microsoft SQL Server 2000 Resolution Service, tracked as CVE-2002-0649. Microsoft had released a patch roughly six months before the outbreak, in July 2002.

Two design properties made it exceptionally fast. First, the entire worm fit in a single 376-byte UDP packet, so it required no connection handshake and no multi-packet transfer. Second, because UDP is connectionless, the worm could fire packets at randomly generated addresses as fast as the host's bandwidth allowed, without waiting for responses. The limiting factor on its spread was network bandwidth, not the worm's own logic.

Why It Mattered

Slammer carried no destructive payload; the damage was entirely a side effect of its propagation traffic saturating networks. It demonstrated that availability impact alone, from scanning volume rather than intent, can constitute a serious incident.

OWASP / CWE Mapping

  • CWE-121: Stack-based Buffer Overflow
  • OWASP A06:2021: Vulnerable and Outdated Components (a patch existed and was not applied)

Lasting Impact

Slammer is the earliest of several incidents on this list (with WannaCry and ProxyLogon) sharing one root pattern: the vulnerability was known and patched well in advance, and the damage came from patch adoption lag rather than from the attacker's sophistication. It also contributed to the industry shift toward host firewalls blocking unnecessary inbound ports by default.

How Safeguard Helps

The recurring lesson across two decades is that knowing what you run, and whether it is patched, is the determining factor. Safeguard's inventory and vulnerability tracking targets that specific gap, including for services that are easy to forget are listening.

References

sql-slammercve-2002-0649wormbuffer-overflowcwe-1212003
Back to all articles

Related articles in Vulnerability Analysis

Vulnerability Analysis

Citrix Bleed (CVE-2023-4966): Stolen Sessions That Walked Past MFA

A factual look at Citrix Bleed, a 2023 buffer over-read in NetScaler appliances that leaked valid session tokens, allowing attackers to hijack authenticated sessions without credentials or a second factor.

September 17, 2026Read
Vulnerability Analysis

Patch Lag Explains the Old Breaches. It Does Not Explain the New Ones.

Reviewing two decades of major incidents, the ones that defined early security were patch-adoption failures. A growing share of recent ones had no patch to apply, because the compromise was in the distribution chain itself. These need different defences.

September 17, 2026Read
Vulnerability Analysis

polyfill.io (2024): What Happens When a CDN Domain Changes Hands

A factual account of the 2024 polyfill.io incident, in which a widely embedded JavaScript CDN domain was acquired and began serving malicious code to a large number of websites.

September 17, 2026Read

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

Book a demoGet started

No sales call required, even your agent can complete the purchase over MCP.