Description

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T20:18:27.513Z",
  "pubdate": "2026-08-28T20:18:27.513Z",
  "executiveSummary": "The ALOS HTTP web framework is susceptible to an out-of-bounds (OOB) panic vulnerability resulting from improper input validation in request path handling.\nThe vulnerability occurs within the core/utils.go file, where a malformed request path containing only a question mark triggers an unchecked array access.\nThis flaw allows an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition by crashing the server process.\nBecause the panic occurs before the core.Recovery() middleware can intercept the exception, the server process terminates abruptly.\nThis issue affects all versions of ALOS HTTP prior to 0.0.0-20260617230736-314b6783e196.\nThe vulnerability is critical for service availability, as it requires no authentication or special privileges to trigger and can be exploited over the network via standard HTTP/1 or HTTP/3 request streams.",
  "technicalDetails": "The vulnerability originates in core/utils.go within the sanitizeRequestPath function. The function is designed to process incoming request paths, typically by invoking splitPathQuery to separate the path from the associated query string.\nWhen a client provides a request path consisting solely of a question mark (e.g., '/?'), the logic within splitPathQuery returns a result that, when processed by sanitizeRequestPath, results in an empty slice or improperly indexed structure. The subsequent code performs an unchecked access (p[0]) on the result of the splitting operation without verifying that the slice contains any elements.\nThis unchecked access triggers a runtime panic in the Go environment when the index is out of bounds.\nThe attack flow initiates when an unauthenticated client sends a maliciously crafted request head through one of several entry points: h1_plain.go::ParseH1RequestHead (for HTTP/1), hpack.go::decodeSimpleGetPathHTTPSRequest or hpack.go::observeHeader (for HPACK-compressed headers), or h3_conn.go::handleRequestStream (for HTTP/3).\nBecause the panic is raised at the core logic layer during the initial parsing and sanitization phase, it bypasses the core.Recovery() middleware, which is intended to handle and recover from panics during request processing. Consequently, the runtime environment cannot recover from the crash, leading to an immediate termination of the server process.\nSuccessful exploitation results in a persistent denial-of-service, as the server process must be manually restarted. Because the attack vector is exposed via standard HTTP/1 and HTTP/3 headers, any public-facing ALOS HTTP server is vulnerable to remote, unauthenticated exploitation. The vulnerability is explicitly fixed in version 0.0.0-20260617230736-314b6783e196, where bounds checking logic was implemented to validate that the request path is not empty before index access occurs."
}