CVE-2026-55484: ALOS HTTP Framework DOS Vulnerability

CVE-2026-55484 Overview

CVE-2026-55484 affects ALOS HTTP, a Linux-first Go web framework and application server built around a custom networking stack. The vulnerability resides in core/utils.go::sanitizeRequestPath, which calls splitPathQuery on a request path beginning with a question mark. The function then performs an unchecked p[0] access without verifying that the resulting path slice is empty. An unauthenticated remote attacker can send a question-mark-only path to trigger an out-of-bounds panic. The panic occurs before core.Recovery() middleware runs, terminating the server process and denying service to all clients.

Critical Impact
Unauthenticated attackers can crash ALOS HTTP servers with a single malformed HTTP request, causing full service outage.

Affected Products

ALOS HTTP framework (Go module github.com/guno1928/alos-http)
All versions prior to pseudo-version 0.0.0-20260617230736-314b6783e196
HTTP/1, HTTP/2 (HPACK), and HTTP/3 request-handling paths

Discovery Timeline

2026-08-28 - CVE-2026-55484 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55484

Vulnerability Analysis

The defect is an uncaught exception ([CWE-248]) that manifests as an out-of-bounds slice access in Go. When ALOS HTTP receives a request whose target begins with ?, sanitizeRequestPath invokes splitPathQuery and immediately dereferences p[0]. If the path component is empty, the index read triggers a runtime panic. The panic propagates through the request-parsing goroutine before core.Recovery() middleware can catch it. Because the panic originates in the low-level networking layer, the entire server process terminates rather than only the offending request. All active connections drop and the service becomes unavailable until an operator restarts the process.

Root Cause

The root cause is missing bounds validation on the return value of splitPathQuery. The function assumes at least one path segment exists, but a request line such as GET ? HTTP/1.1 produces an empty slice. Recovery middleware is registered at the application layer, above the parsing routines that panic, so it never runs for this input.

Attack Vector

An unauthenticated remote attacker sends a single malformed HTTP request to any listener. The vulnerable code path is reachable through multiple entry points: h1_plain.go::ParseH1RequestHead for HTTP/1, hpack.go::decodeSimpleGetPathHTTPSRequest and hpack.go::observeHeader for HTTP/2, and h3_conn.go::handleRequestStream for HTTP/3. No authentication, session state, or user interaction is required.

text

# .gitignore hardening included in the fix commit
+# Ignore everything by default.
+/*
+
+# Then allow ONLY what should be published to GitHub.
+!/.gitignore
+!/README.md
+!/go.mod
+!/go.sum
+!/main.go
+!/core/
+
+# Within core/, keep build artifacts and local junk out.
core/*.exe
core/*.test
core/*.out
core/*.prof

Source: GitHub Commit 314b6783. The referenced commit bundles the panic fix with repository hardening and additional bug fixes.

Detection Methods for CVE-2026-55484

Indicators of Compromise

Unexpected termination of ALOS HTTP server processes correlated with inbound HTTP traffic
Access log entries containing request lines beginning with ? or containing only a question mark as the path
Go runtime panic stack traces referencing sanitizeRequestPath, splitPathQuery, or ParseH1RequestHead
Repeated short-lived TCP connections from a single source immediately preceding a service outage

Detection Strategies

Inspect web server and reverse-proxy logs for anomalous request targets that start with ? or lack a valid path component.
Monitor process supervisors (systemd, Kubernetes liveness probes) for restart loops of ALOS HTTP workloads.
Deploy web application firewall rules that reject HTTP request lines where the path component is empty or consists only of a query delimiter.

Monitoring Recommendations

Alert on Go panic signatures in stdout, stderr, or centralized log pipelines from services built on ALOS HTTP.
Track request-rate spikes paired with sudden drops in successful response counts as a signal of crash-restart cycles.
Correlate HTTP/2 and HTTP/3 stream reset events with process exit codes to identify targeted abuse.

How to Mitigate CVE-2026-55484

Immediate Actions Required

Upgrade the github.com/guno1928/alos-http dependency to pseudo-version 0.0.0-20260617230736-314b6783e196 or later and rebuild all binaries.
Place ALOS HTTP servers behind a reverse proxy or WAF that normalizes request targets and drops malformed request lines.
Ensure process supervisors automatically restart crashed services while the patch is being deployed.

Patch Information

The issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196. Review the fix in the GitHub commit 314b6783 and the GitHub Security Advisory GHSA-hr6j-w4mw-g9mj for full details.

Workarounds

Configure an upstream proxy (NGINX, Envoy, HAProxy) to reject requests whose path equals ? or is empty.
Rate-limit inbound HTTP requests per source IP to slow crash-loop exploitation until the patch is applied.
Restrict exposure of ALOS HTTP listeners to trusted networks where feasible.

bash

# Update the Go module to the fixed pseudo-version
go get github.com/guno1928/alos-http@v0.0.0-20260617230736-314b6783e196
go mod tidy
go build ./...