CVE-2017-14149

High

Published: 05/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

GoAhead versions 3.4.0 through 3.6.5 have a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a 'POST / HTTP/1.1' request.

Risk Assessment

This vulnerability may lead to service downtime, affecting application continuity and potentially impacting end users.

Recommendation

It is recommended to upgrade to the latest version of GoAhead to mitigate this vulnerability.

Other vulnerabilities in GoAhead

CVE-2026-36356Critical
An unauthenticated OS command injection vulnerability exists in the GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1). The attack is possible via the /action/SetRemoteAccessCfg endpoint.

Original NVD description (English source)

GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS