high · 7.5CVE-2026-55484Aug 28, 2026

CVE-2026-55484: alos-http Unauthenticated Remote Denial of Service via Malformed Path

Rohit Hatagale
AI Security Researcher, SecureLayer7

A single HTTP request with a path starting with '?' crashes the entire alos-http server process due to an unchecked index into an empty string, taking down all connections instantly.

Packagegithub.com/guno1928/alos-http
Ecosystemgo
Affected< 0.0.0-20260617230736-314b6783e196
Fixed in0.0.0-20260617230736-314b6783e196
CVE-2026-55484: alos-http Unauthenticated Remote Denial of Service via Malformed Path

The problem

The function sanitizeRequestPath in core/utils.go splits the request path on ? to strip the query string, then immediately indexes byte zero of the result without checking whether the result is empty.

When the raw path is exactly ?, the top-level length guard passes (length is 1, not 0), splitPathQuery returns an empty string for the path component, and p[0] panics with "index out of range". This panic fires inside the connection-worker goroutine before any handler or middleware runs, so core.Recovery() cannot catch it, and the whole process exits.

HTTP/1.1, HTTP/2, and HTTP/3 transports are all affected because the same function is called from h1_plain.go, hpack.go, and h3_conn.go.

Proof of concept

A working proof-of-concept for CVE-2026-55484 in github.com/guno1928/alos-http, with the exact payload below.

bash
printf 'GET ? HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8080

The root cause is CWE-129 / CWE-703: after p, _ := splitPathQuery(path) the code does if p[0] == '/' with no prior len(p) > 0 guard. A path of exactly ? satisfies the early len(path) == 0 bypass (length is 1) but produces an empty path component, triggering a Go runtime bounds-check panic.

The patch commit 314b6783e196 adds a len(p) == 0 check immediately after splitPathQuery returns, returning "/" in that case. This is the minimal change that closes the crash path without altering normal routing behavior.

Because the panic escapes the goroutine's call stack before any recover-deferred function can intercept it, wrapping handlers in core.Recovery() provides no mitigation.

The fix

Upgrade to commit 0.0.0-20260617230736-314b6783e196 or any later version. In go.mod: require github.com/guno1928/alos-http v0.0.0-20260617230736-314b6783e196. If you cannot upgrade immediately, place a reverse proxy (nginx, Caddy, HAProxy) in front of the server and configure it to reject request lines whose path component starts with ?.

Reporter not attributed.

References: [1][2][3]

Related research