GCVE - cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*

part: a version: 3.6.5 update: *

Vendor	Embedthis (`3645b664-79bb-5f0b-b706-619126e3cef7`)
Product	Goahead (`0f251e4a-da4d-53e9-a8b2-32638ff738b1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/embedthis/goahead`	purl2cpe	2026-06-01 10:11:27.086909

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-5097`	vulnerable	2026-06-08 05:13:57.690684	Details available MEDIUM (5.3) A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server. Published: 2019-12-03T21:49:38.000Z Updated: 2024-08-04T19:47:56.843Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-5096`	vulnerable	2026-06-08 05:13:57.688785	Details available CRITICAL (9.8) An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server. Published: 2019-12-03T21:52:15.000Z Updated: 2024-08-04T19:47:55.928Z Open on db.gcve.eu Reference links https://talosintelligence.com/vulnerability_reports/TALOS-2019-0888	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14149`	vulnerable	2026-06-08 05:08:49.402205	Details available GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request. Published: 2017-09-05T07:00:00.000Z Updated: 2024-09-16T18:55:35.449Z Open on db.gcve.eu Reference links https://github.com/shadow4u/goaheaddebug/blob/master/README.md	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.