CVE-2026-55484High· 7.5▾ TwilightALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning wi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a question mark and then performs the unchecked p[0] access without checking whether the resulting path is empty. An unauthenticated client can send a malformed request such as a question-mark-only path through h1_plain.go::ParseH1RequestHead, hpack.go::decodeSimpleGetPathHTTPSRequest, hpack.go::observeHeader, or h3_conn.go::handleRequestStream, causing an out-of-bounds panic before core.Recovery() middleware runs and terminating the server process. This issue is fixed in pseudo-version 0.0.0-20260617230736-314b6783e196.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/guno1928/alos-http < 0.0.0-20260617230736-314b6783e196Patched in:
github.com/guno1928/alos-http 0.0.0-20260617230736-314b6783e196Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85014Medium· 5.9undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer closes the TCP connection without a WebSocket close handshake
CVE-2026-44001High· 8.6vm2 is an open source vm/sandbox for Node.js
CVE-2026-31812Medium· 5.3Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol
GHSA-c8w6-x74f-vmg3Medium· 6.5zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers
CVE-2026-33939High· 7.5Handlebars provides the power necessary to let users build semantic templates
GHSA-wjjj-24cx-f28gHigh· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call