CVE-2019-19945

uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash. It can be triggered with an HTTP POST request to a CGI script, specifying both "Transfer-Encoding: chunked" and a large negative Content-Length value.

• CWE-125
• CWE-681

• https://github.com/openwrt/openwrt/commits/masterPatch, Third Party Advisory
• https://openwrt.org/advisory/2020-01-13-1Vendor Advisory
• https://github.com/openwrt/openwrt/commits/masterPatch, Third Party Advisory
• https://openwrt.org/advisory/2020-01-13-1Vendor Advisory

Published

Mar 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1994In refresh of DevelopmentTiles.java, there is the possibilit…
• CVE-2019-19940Incorrect input sanitation in text-oriented user interfaces …7.2
• CVE-2019-19941Missing hostname validation in Swisscom Centro Grande before…5.4
• CVE-2019-19942Missing output sanitation in Swisscom Centro Grande Centro G…7.5
• CVE-2019-19943The HTTP service in quickweb.exe in Pablo Quick 'n Easy Web …7.5
• CVE-2019-19944In libIEC61850 1.4.0, BerDecoder_decodeUint32 in mms/asn1/be…6.5
• CVE-2019-19946The API in Dradis Pro 3.4.1 allows any user to extract the c…6.5
• CVE-2019-19947In the Linux kernel through 5.4.6, there are information lea…4.6
• CVE-2019-19948In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer ov…9.8
• CVE-2019-19949In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer ov…9.1
• CVE-2019-1995In ComposeActivityEmail of ComposeActivityEmail.java, there …
• CVE-2019-19950In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-a…9.8