CVE-2019-5097 Denial of service in EmbedThis

What is CVE-2019-5097?

CVE-2019-5097 is a medium-severity denial of service vulnerability in EmbedThis, published on 3 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

Weakness: CWE-835

Which versions are affected by CVE-2019-5097?

It affects 1 product.

Products include Embedthis Goahead.

How do I fix CVE-2019-5097?

No fix has been published for CVE-2019-5097 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-5097 being exploited?

There is no known exploitation of CVE-2019-5097 in the wild and no public exploit code.

Other vulnerabilities in EmbedThis

• CVE-2017-17562 Embedthis GoAhead Remote Code Execution Exploited High 8.1
• CVE-2021-41615 Weak cryptography in n/a Critical 9.8
• CVE-2021-43298 Security feature bypass in goahead Critical 9.8
• CVE-2021-42342 File upload in n/a Critical 9.8
• CVE-2019-5096 Use after free in EmbedThis Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cj8r-mppq-qjm5.