Skip to content
Fencer Intel
medium 5.3

CVE-2019-5097 json

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in v…

published 6y ago modified 4mo ago also EUVD-2019-14702

cvss
5.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
45.1%
EPSS 45.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web server application in versions v5.0.1, v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to an infinite loop in the process. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.

Is CVE-2019-5097 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-319-16 updated cvss 7.5

Hitachi Energy MSM (Update A)

  • Hitachi Energy MSM
    not affected

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-026-06 updated cvss 7.5

Rockwell Automation products using GoAhead Web Server

  • Rockwell Automation 1732E-8CFGM8R/A 1.012 Rockwell Automation 1732E-8IOLM12R 2.011 Rockwell Automation 1732E-IB8M8SOER 1.012 Rockwell Automation 1732E-IF4M12R/A (discontinued) 1.012 Rockwell Automation 1732E-IR4IM12R/A 1.012 Rockwell Automation 1732E-IT4IM12R/A 1.012
    +21 more products
    Rockwell Automation 1732E-OB8M8SR/A 1.013 Rockwell Automation 1732E-OF4M12R/A 1.012 Rockwell Automation 1747-AENTR 2.002 Rockwell Automation 1756- EN2T/D 11.001 Rockwell Automation 1756-EN2F/C 11.001 Rockwell Automation 1756-EN2T/D <= 11.001 Rockwell Automation 1756-EN2TP/A 11.001 Rockwell Automation 1756-EN2TR/C <= 11.001, 11.001 Rockwell Automation 1756-EN2TSC/B 10.01 Rockwell Automation 1756-EN2TSC/B (discontinued) 10.01 Rockwell Automation 1756-HIST1G/A (discontinued) <= 3.054 Rockwell Automation 1756-HIST2G/A(discontinued) <= 3.054 Rockwell Automation 1756-HIST2G/B <= 5.103 Rockwell Automation 1765 - EN3TR/B 11.001 Rockwell Automation 1769-AENTR 1.001 Rockwell Automation 5069-AEN2TR 3.011 Rockwell Automation Compact GuardLogix 5380 controllers 31 - 32 Rockwell Automation CompactLogix 5380 controllers 28 - 32 Rockwell Automation CompactLogix 5480 controllers 32 Rockwell Automation ControlLogix 5580 controllers 28 - 32 Rockwell Automation GuardLogix 5580 controllers 31 - 32
    affected: mitigation “1769-AENTR: Update to 1.003 or later” rockwellautomation.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

45.06% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • talosintelligence.com https://talosintelligence.com/vulnerability_reports/TALOS-2019-0889 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a EmbedThis

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.