Vulnerability record · CVE-2020-15689 · published 13 July 2020

CVE-2020-15689: Embedthis appweb null pointer dereference vulnerability

Embedthis · Appweb

Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.

7.5 CVSS 3.1 High EPSS 1.3% · top 30.1% CWE-476 · NULL pointer dereference

7.5CVSS 3.1 base score, v2 5.0

1.3%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Appweb Embedthis

References

Link	Tags
https://github.com/embedthis/appweb-gpl/issues/2	Broken Link
https://github.com/embedthis/appweb-gpl/issues/2	Broken Link

Track CVE-2020-15689 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2018-8715Embedthis appweb improper authentication vulnerabilityThe Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forge…EPSS 23%15 Mar 2018 7.5CVE-2021-33254Embedthis appweb null pointer dereference vulnerabilityAn issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stre…EPSS 1.5%2 Jun 2022 7.5CVE-2018-15504Embedthis appweb null pointer dereference vulnerabilityAn issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with tim…EPSS 2.8%18 Aug 2018 7.5CVE-2018-15505Embedthis appweb null pointer dereference vulnerabilityAn issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field …EPSS 2.2%18 Aug 2018 5.0CVE-2014-9708Embedthis Appweb NULL pointer dereference via empty Range headerEmbedthis Appweb before 4.6.6 and 5.x before 5.2.1 dereferences a NULL pointer when it receives a Range header with an empty value, such as "Range: x…EPSS 56%analysed31 Mar 2015 6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed10 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2020-15689), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.