https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2009-5111.htmlhttps://patchthecve.com/cve/CVE-2009-5111.htmlTue, 16 Jun 2026 23:15:06 +0000MEDIUM 5.0: GoAhead WebServer allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.https://patchthecve.com/cve/CVE-2011-4273.htmlhttps://patchthecve.com/cve/CVE-2011-4273.htmlTue, 16 Jun 2026 23:34:41 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via (1) the group parameter to goform/AddGroup, related to addgroup.asp; (2) the url parameter to goform/AddAccessLimit, related to addlimit.asp; or the (3) usehttps://patchthecve.com/cve/CVE-2003-1569.htmlhttps://patchthecve.com/cve/CVE-2003-1569.htmlTue, 16 Jun 2026 22:04:40 +0000MEDIUM 5.0: GoAhead WebServer before 2.1.5 on Windows 95, 98, and ME allows remote attackers to cause a denial of service (daemon crash) via an HTTP request with a (1) con, (2) nul, (3) clock$, or (4) config$ device name in a path component, different vectors than CVE-2001-0385.https://patchthecve.com/cve/CVE-2003-1568.htmlhttps://patchthecve.com/cve/CVE-2003-1568.htmlTue, 16 Jun 2026 22:04:40 +0000MEDIUM 5.0: GoAhead WebServer before 2.1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an invalid URL, related to the websSafeUrl function.https://patchthecve.com/cve/CVE-2002-2431.htmlhttps://patchthecve.com/cve/CVE-2002-2431.htmlTue, 16 Jun 2026 22:01:17 +0000HIGH 7.5: Unspecified vulnerability in GoAhead WebServer before 2.1.4 allows remote attackers to cause "incorrect behavior" via unknown "malicious code," related to incorrect use of the socketInputBuffered function by sockGen.c.https://patchthecve.com/cve/CVE-2002-2430.htmlhttps://patchthecve.com/cve/CVE-2002-2430.htmlTue, 16 Jun 2026 22:01:17 +0000MEDIUM 5.0: GoAhead WebServer before 2.1.1 allows remote attackers to cause a denial of service (CPU consumption) by performing a socket disconnect to terminate a request before it has been fully processed by the server.https://patchthecve.com/cve/CVE-2002-2429.htmlhttps://patchthecve.com/cve/CVE-2002-2429.htmlTue, 16 Jun 2026 22:01:17 +0000MEDIUM 5.0: webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (daemon crash) via an HTTP POST request that contains a negative integer in the Content-Length header.https://patchthecve.com/cve/CVE-2002-2428.htmlhttps://patchthecve.com/cve/CVE-2002-2428.htmlTue, 16 Jun 2026 22:01:16 +0000MEDIUM 5.0: webs.c in GoAhead WebServer before 2.1.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP POST request that contains a Content-Length header but no body data.https://patchthecve.com/cve/CVE-2002-2427.htmlhttps://patchthecve.com/cve/CVE-2002-2427.htmlTue, 16 Jun 2026 22:01:16 +0000MEDIUM 5.0: The security handler in GoAhead WebServer before 2.1.1 allows remote attackers to bypass authentication and obtain access to protected web content via "an extra slash in a URL," a different vulnerability than CVE-2002-1603.