CVE-2019-19945

HIGH LAB

OpenWrt 18.06.0-18.06.5 and 19.x through 19.07.0-rc2 - Denial of Service via uhttpd Integer Signedness Error

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-19945. PoCs published by delicateByte.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2019-19945, which targets a vulnerability in uhttpd where a negative Content-Length in a POST request causes a denial-of-service (DoS). The exploit uses Docker containers to set up a vulnerable server and a client that sends the malicious request.

Description

uhttpd in OpenWrt through 18.06.5 and 19.x through 19.07.0-rc2 has an integer signedness error. This leads to out-of-bounds access to a heap buffer and a subsequent crash. It can be triggered with an HTTP POST request to a CGI script, specifying both "Transfer-Encoding: chunked" and a large negative Content-Length value.

Exploits (1)

nomisec WORKING POC
by delicateByte · poc
https://github.com/delicateByte/CVE-2019-19945_Test

This repository contains a functional exploit for CVE-2019-19945, which targets a vulnerability in uhttpd where a negative Content-Length in a POST request causes a denial-of-service (DoS). The exploit uses Docker containers to set up a vulnerable server and a client that sends the malicious request.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: uhttpd (version not explicitly specified, but likely older versions)
No auth needed
Prerequisites: Docker installed · Vulnerable uhttpd server
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (2)

Core 2
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/openwrt/openwrt/commits/master
Vendor Advisory x_refsource_confirm
https://openwrt.org/advisory/2020-01-13-1

Scores

CVSS v3 7.5
EPSS 0.0155
EPSS Percentile 71.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull archlinux:latest

Details

CWE
CWE-681 CWE-125
Status published
Products (2)
openwrt/openwrt 19.07.0 (3 CPE variants)
openwrt/openwrt 18.06.0 - 18.06.5
Published Mar 16, 2020
Tracked Since Feb 18, 2026