Vulnerabilities > CVE-2019-12822 - Expression Language Injection vulnerability in Embedthis Goahead

Summary

In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory assertion, out-of-bounds memory reference, and potential DoS, as demonstrated by a colon on a line by itself.

Vulnerable Configurations

Common Weakness Enumeration (CWE)

• CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

References