High, CVSS 7.5GoAmendedPublished
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
CVE-2026-55484 · GHSA-hr6j-w4mw-g9mj
- Affected
- Go github.com/guno1928/alos-http < 0.0.0-20260617230736-314b6783e196
- Fixed in
- 0.0.0-20260617230736-314b6783e196· Vendor fix available
- Issue
- A single unauthenticated HTTP request to a path starting with ? (e.g. GET ? HTTP/1.1) crashes the entire server process. The request line parser passes the path to sanitizeRequestPath which indexes the first byte of the path after stripping the query string. It does so without checking that it is non-empty, leading to an out-of-bounds panic. The panic occurs before any handler or middleware runs so core.Recovery() does not recover it. The entire process panics and every connection is dropped. It is reachable over HTTP/1.1, HTTP/2 and HTTP/3 if ListenAndServeQUIC is enabled Details root cause: core/utils.go::sanitizeRequestPath when the path starts with "?" len(path) is not 0 so the early return does not fire after splitPathQuery p is empty "" p is then indexed p[0] without a length check Relevant calling sites: h1plain.go:ParseH1RequestHead (HTTP/1.1) h1.go::ParseH1Request (dead code) hpack.go::decodeSimpleGetPathHTTPSRequest (HTTP/2) hpack.go::observeHeader (HTTP/2)…
Recommended action: Upgrade to 0.0.0-20260617230736-314b6783e196 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.