CVE-2026-55484
- Source
- https://cve.org/CVERecord?id=CVE-2026-55484
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55484.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55484
- Aliases
- Downstream
- Related
- Published
- 2026-08-28T19:19:19Z
- Modified
- 2026-09-11T03:30:16Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
- Details
-
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-248", "CWE-754" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55484.json", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "0.0.0-20260617230736-314b6783e196" } ], "source": "AFFECTED_FIELD" }, { "extracted_events": [ { "fixed": "h1_plain.go" }, { "fixed": "core.Recovery" } ], "source": "DESCRIPTION" } ] }- References