CVE-2019-19240

Embedthis GoAhead before 5.0.1 mishandles redirected HTTP requests with a large Host header. The GoAhead WebsRedirect uses a static host buffer that has a limited length and can overflow. This can cause a copy of the Host header to fail, leaving that buffer uninitialized, which may leak uninitialized data in a response.

• CWE-787
• CWE-908

• https://github.com/embedthis/goahead/issues/289Exploit, Third Party Advisory
• https://github.com/embedthis/goahead/issues/290Third Party Advisory
• https://github.com/embedthis/goahead/releases/tag/v5.0.1Release Notes
• https://github.com/embedthis/goahead/issues/289Exploit, Third Party Advisory
• https://github.com/embedthis/goahead/issues/290Third Party Advisory
• https://github.com/embedthis/goahead/releases/tag/v5.0.1Release Notes

Published

Nov 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19230An unsafe deserialization vulnerability exists in CA Release…9.8
• CVE-2019-19231An insecure file access vulnerability exists in CA Client Au…7.8
• CVE-2019-19232In Sudo through 1.8.29, an attacker with access to a Runas A…7.5
• CVE-2019-19234In Sudo through 1.8.29, the fact that a user has been blocke…7.5
• CVE-2019-19235AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windo…7
• CVE-2019-1924Multiple vulnerabilities in Cisco Webex Network Recording Pl…7.8
• CVE-2019-19241In the Linux kernel before 5.4.2, the io_uring feature leads…7.8
• CVE-2019-19242SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by t…5.9
• CVE-2019-19244sqlite3Select in select.c in SQLite 3.30.1 allows a crash if…7.5
• CVE-2019-19245NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authen…9.8
• CVE-2019-19246Oniguruma through 6.9.3, as used in PHP 7.3.x and other prod…7.5
• CVE-2019-19247Electronic Arts Origin through 10.5.x allows Elevation of Pr…7.8