CVE-2019-5097: GoAhead web server multipart/form-data request infinite loop DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with low attack complexity and a high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

The base GoAhead web server (v5.0.1, v4.1.1, v3.6.5) enters an infinite loop while processing specially crafted multipart/form-data requests. Because the request can be unauthenticated and the target resource need not exist, any reachable server instance is exposed to a trivial remote denial of service.

Impact

An attacker can hang the server process, denying service to legitimate users; no data confidentiality or integrity impact is described.

Attack surface

Reachable over the network via HTTP GET or POST requests to the web server; no authentication and no user interaction are required, and the requested resource does not need to exist.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but the reference is tagged Exploit and EPSS is 0.45 (98.7th percentile), indicating meaningful likelihood of exploitation.

What to do

• Upgrade GoAhead to a version later than v5.0.1, v4.1.1 or v3.6.5 that contains the fix; verify the vendor advisory for the corrected release.
• If immediate upgrade is not possible, restrict network access to the GoAhead listener with firewall rules or a reverse proxy that filters malformed multipart/form-data requests.
• Enforce request size and multipart parsing limits at the front-end proxy to reject oversized or malformed bodies before they reach GoAhead.
• Monitor the GoAhead process for CPU saturation and restart it automatically if it becomes unresponsive.

Detection

• Alert on sustained high CPU or unresponsive GoAhead processes correlated with inbound multipart/form-data requests.
• Log and inspect HTTP requests with multipart/form-data content types, especially those targeting non-existent resources or with malformed boundaries.
• Track repeated GET/POST requests from a single source that precede a service hang or restart.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.