Description
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.
Published: 2026-08-28
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Server Crash)
Action: Apply Patch
AI Analysis

Impact

A flaw in ALOS HTTP’s request‑path sanitization triggers an out‑of‑bounds panic when the path starts with a question mark and contains no actual path. The unchecked array access in sanitizeRequestPath causes the server process to crash before recovery middleware runs, resulting in a denial of service. This weakness falls under out‑of‑bounds read and improper resource handling.

Affected Systems

The vulnerability affects the guno1928:alos‑http Web framework, which is a Linux‑first Go application server. All releases prior to 0.0.0‑20260617230736‑314b6783e196 are impacted, regardless of deployment environment.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, and the EPSS score is not available. The issue is not listed in the CISA KEV catalog. An attacker can trigger the panic from any unauthenticated client by sending a malformed request path beginning with a question mark via HTTP/1.1 or HTTP/3. The attack requires no special privileges and can be performed over the public network, making exploitation straightforward and highly likely if the server is exposed.

Generated by OpenCVE AI on August 28, 2026 at 20:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the ALOS HTTP library to version 0.0.0‑20260617230736‑314b6783e196 or later.
  • Restart or reload the server process to ensure the bug fix takes effect.
  • Configure a reverse proxy or firewall to reject any HTTP request whose path begins with a question mark to block the malformed input from reaching the application.

Generated by OpenCVE AI on August 28, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-hr6j-w4mw-g9mj alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
History

Mon, 31 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Guno1928
Guno1928 alos-http
Vendors & Products Guno1928
Guno1928 alos-http

Fri, 28 Aug 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.
Title ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
Weaknesses CWE-248
CWE-754
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Guno1928 Alos-http
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-28T20:00:26.302Z

Reserved: 2026-06-16T22:28:27.061Z

Link: CVE-2026-55484

cve-icon Vulnrichment

Updated: 2026-08-28T20:00:07.479Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T20:18:27.513

Modified: 2026-09-09T21:09:13.080

Link: CVE-2026-55484

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T11:20:05Z

Weaknesses
  • CWE-248

    Uncaught Exception

  • CWE-754

    Improper Check for Unusual or Exceptional Conditions