CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2026-55484
High (7.5). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/guno1928/alos-http 0.0.0-20260617230736-314b6783e196.
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-248, CWE-754
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hr6j-w4mw-g9mj | Go | github.com/guno1928/alos-http | <0.0.0-20260617230736-314b6783e196 | 0.0.0-20260617230736-314b6783e196 |
| GO-2026-6321 | Go | github.com/guno1928/alos-http | <0.0.0-20260617230736-314b6783e196 | 0.0.0-20260617230736-314b6783e196 |