CVE-2019-12822

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and potential DoS, as demonstrated by a colon on a line by itself.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-917

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/embedthis/goahead/compare/5349710...579f21fPatch, Third Party Advisory
https://github.com/embedthis/goahead/issues/285Patch, Third Party Advisory
https://github.com/embedthis/goahead/compare/5349710...579f21fPatch, Third Party Advisory
https://github.com/embedthis/goahead/issues/285Patch, Third Party Advisory

Timeline

Published: Jun 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-128236.1Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.CVE-2019-128254.3Unauthorized Access to the Container Registry of other groups was discovered in GitLab Enterprise 12.0.0-pre. In other words, authenticated CVE-2019-128268.8A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows CVE-2019-128276.5Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authentica CVE-2019-128288.8An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, CVE-2019-128297.5radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application crash) or possibly CVE-2019-12835.5An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphi CVE-2019-128308.7In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to [video] BBCode persistent CVE-2019-128317.2In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too l CVE-2019-128346.1In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATH_INFO CVE-2019-128359.8formats/xml.cpp in Leanify 0.4.3 allows for a controlled out-of-bounds write in xml_memory_writer::write via characters that require escapin CVE-2019-128368.8The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link (to an existing issue) that can cause forgery of a re