Description
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort("", ":5553") resolves to ":5553". This vulnerability is fixed in 1.17.7.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| xyproto | algernon | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-gj84-924c-48fx | Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS |
References
History
Tue, 26 May 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort("", ":5553") resolves to ":5553". This vulnerability is fixed in 1.17.7. | |
| Title | Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS | |
| Weaknesses | CWE-1188 CWE-668 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-26T16:41:42.059Z
Reserved: 2026-05-13T22:18:22.830Z
Link: CVE-2026-46430
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-26T17:16:50.943
Modified: 2026-05-26T17:16:50.943
Link: CVE-2026-46430
Redhat
No data.
OpenCVE Enrichment
No data.