CVE-2017-14149: Embedthis GoAhead

High severity, CVSS 7.5. EPSS: 5.8% chance of exploitation in the next 30 days.

GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a "POST / HTTP/1.1" request.

Affected products

• Embedthis GoAhead: version 3.4.0 only; version 3.4.1 only; version 3.4.2 only; version 3.4.3 only; version 3.4.4 only; version 3.4.5 only; …

Published 2017-09-05. Last modified 2026-06-17.