Read the docs
TI-2019-03557 Aliases CVE-2019-5096GHSA-xcxv-6fr5-34fm

Use after free in EmbedThis

Priority HIGH 79CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests, and does not require the requested resource to exist on the server.

Why it matters now

EPSS 0.67211 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—EmbedThisEmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5—No fix listedCNA
  • EmbedThis Vendor— Affected EmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*3.6.5VulnerableEmbedthis
cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableEmbedthis
cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableEmbedthis
  • cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·Embedthis
  • cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Embedthis
  • cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Embedthis

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5096
  2. 2026-10-03 Alias added: GHSA-xcxv-6fr5-34fm

References

Exploit 1

  • TI-2017-12833 Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI… KEVCVSS 3.1HIGH 8.1
  • TI-2021-18771 An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. CVSS 3.1CRITICAL 9.8
  • TI-2017-03674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and… CVSS 3.0CRITICAL 9.8
  • TI-2019-03558 Infinite loop in EmbedThis CVSS 3.1HIGH 7.5
  • TI-2014-07892 EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting… CVSS 2.0HIGH 7.5
  • TI-2017-14680 EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in… CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences