CVE-2018-15504: Embedthis Appweb

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.

Affected products

• Embedthis Appweb: before 7.0.2 (fixed in 7.0.2)
• Embedthis GoAhead: before 4.0.1 (fixed in 4.0.1)
• Juniper Junos: version 12.1x46 only; version 12.3x48 only; version 15.1x49 only; version 12.3 only; version 15.1 only; version 15.1x53 only; …

Published 2018-08-18. Last modified 2026-06-17.