Read the docs
TI-2019-03558 Aliases CVE-2019-5097GHSA-cj8r-mppq-qjm5

Infinite loop in EmbedThis

Priority MEDIUM 62CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-835.

Summary

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

Why it matters now

EPSS 0.45063 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—EmbedThisEmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5—No fix listedCNA
  • EmbedThis Vendor— Affected EmbedThis GoAhead Web Server v5.0.1 EmbedThis GoAhead Web Server v4.1.1 EmbedThis GoAhead Web Server v3.6.5 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:*3.6.5VulnerableEmbedthis
cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableEmbedthis
cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:*5.0.1VulnerableEmbedthis
  • cpe:2.3:a:embedthis:goahead:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·Embedthis
  • cpe:2.3:a:embedthis:goahead:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Embedthis
  • cpe:2.3:a:embedthis:goahead:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·Embedthis

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5097
  2. 2026-10-03 Alias added: GHSA-cj8r-mppq-qjm5

References

Exploit 1

  • TI-2017-12833 Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI… KEVCVSS 3.1HIGH 8.1
  • TI-2019-03557 Use after free in EmbedThis CVSS 3.1CRITICAL 9.8
  • TI-2021-18771 An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. CVSS 3.1CRITICAL 9.8
  • TI-2017-03674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and… CVSS 3.0CRITICAL 9.8
  • TI-2014-07892 EmbedThis GoAhead 3.0.0 through 3.4.1 does not properly handle path segments starting… CVSS 2.0HIGH 7.5
  • TI-2017-14680 EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL pointer dereference in… CVSS 3.0CRITICAL 9.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences