CVE-2019-5097CWE-835

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1…

Medium · published December 3, 2019

CVSS v3.0
5.3
EPSS
45%
Percentile
98.8
In the wild
Unconfirmed
What it is

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.45063 · 98.8th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2019-12-03T21:49Z
EPSS history
Timeline
  • 03 DEC 21:49Z
    A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1…
    cvelistv5