CVE-2026-55484

Published: Ago 28, 2026 Last Modified: Ago 29, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.

248

Uncaught Exception

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart Read Application Data
Applicable Platforms
Languages: C++, Java, C#
View CWE Details
754

Improper Check for Unusual or Exceptional Conditions

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability
Potential Impacts:
Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: Medium
View CWE Details
https://github.com/guno1928/alos-http/security/advisories/G…
https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj
https://github.com/guno1928/alos-http/commit/314b6783e19698…
https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6…
https://github.com/guno1928/alos-http/security/advisories/G…
https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj