{"id":9770,"date":"2019-12-23T01:30:45","date_gmt":"2019-12-23T01:30:45","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=9770"},"modified":"2026-04-17T18:07:50","modified_gmt":"2026-04-17T18:07:50","slug":"advisory-two-high-risk-vulnerabilities-goahead-web-server","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/advisory-two-high-risk-vulnerabilities-goahead-web-server\/","title":{"rendered":"Advisory: Two high-risk vulnerabilities in GoAhead web server"},"content":{"rendered":"


\n<\/p>\n

Vulnerability Description<\/strong><\/h2>\n

On December 2, 2019, Cisco Talos publicly released reports of a remote code execution vulnerability (CVE-2019-5096) and a denial of service vulnerability (CVE-2019-5097) for the GoAhead web server. GoAhead is an open source, simple, lightweight, and powerful embedded Web Server. It is a Web server tailored for embedded real-time operating systems (RTOS) and can run on multiple platforms.<\/p>\n

CVE-2019-5096: Some versions of GoAhead Web Server have a remote code execution vulnerability when processing multipart \/ form-data requests. CVE-2019-5097: Some versions of GoAhead Web Server have a denial of service vulnerability when processing multipart \/ form-data requests. An attacker constructing a malicious HTTP request may cause the server process to enter an infinite loop. In the case of authentication, it is sent as GET or POST, and the requested resource is not required on the target server.<\/p>\n

Reference:<\/p>\n

https:\/\/talosintelligence.com\/vulnerability_reports\/TALOS-2019-0888<\/p>\n

https:\/\/talosintelligence.com\/vulnerability_reports\/TALOS-2019-0889<\/p>\n

Scope of Impact<\/strong><\/h2>\n

Affected Versions<\/strong><\/h3>\n