I've read about that report :
http://www.securitytracker.com/alerts/2003/Nov/1008265.html
It talks about that a remote user can send an HTTP POST header line that
does not contain a colon character (':') to cause the target web server to
enter an endless loop.
It says that the 2.5 ( that is the latest version ) is vulnerable.... it
that thrue ? there is something i can do ?
Thanx, Jacopo.