I haven't checked everything yet, but... Did you see the CIAC bulletin? They only recommened the setting of MAX_STRING_LEN and HUGE_STRING_LEN to be equal. Hmmm. Perhaps they didn't see the sprintf's in log_transaction() [for example, in http_log.c])? I've called CIAC & let them know. Your fix may be more complete, but time will tell if it's enough.