In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1 a header parsing vulnerability causes a memory assertion out-of-bounds memory reference and potential DoS as demonstrated by a colon on a line by itself.