CVE-2026-55484 alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server
Unauthenticated attackers can crash the ALOS HTTP server by sending a malformed request path starting with a question mark, causing an out-of-bounds panic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55484?
CVE-2026-55484 is a high-severity denial of service vulnerability in guno1928 alos-http, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.
Which versions are affected by CVE-2026-55484?
3 open source packages ship an affected version, including github.com/guno1928/alos-http.
| Package | Affected | Fixed in |
|---|---|---|
github.com/guno1928/alos-http Go | All versions | 0.0.0-20260617230736-314b6783e196 |
github.com/guno1928/alos-http Go | All versions | 0.0.0-20260617230736-314b6783e196 |
github.com/guno1928/alos-http Go | All versions | 0.0.0-20260617230736-314b6783e196 |
How do I fix CVE-2026-55484?
Upgrade github.com/guno1928/alos-http to 0.0.0-20260617230736-314b6783e196 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-55484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55484 exists.
Sources
Also known as GHSA-hr6j-w4mw-g9mj, GO-2026-6321.