CVE-2026-55484

Name of the Vulnerable Software and Affected Versions ALOS HTTP versions prior to 0.0.0-20260617230736-314b6783e196

Description An unauthenticated client can cause a denial of service by sending a malformed HTTP request with a path consisting only of a question mark. The sanitizeRequestPath() function in core/utils.go calls splitPathQuery() on the request path but fails to verify if the resulting path is empty before attempting to access the first byte p[0]. This leads to an out-of-bounds panic that terminates the entire server process. Because the panic occurs during request parsing, it happens before the core.Recovery() middleware can execute, meaning the server cannot recover and all active connections are dropped. This issue is reachable via HTTP/1.1, HTTP/2, and HTTP/3 (if ListenAndServeQUIC is enabled) through the following functions:

Recommendations Update ALOS HTTP to version 0.0.0-20260617230736-314b6783e196.