Go/github.com/guno1928/alos-http CVE-2026-55484: high 7.5, EPSS 0.49%
alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http
Action: Upgrade github.com/guno1928/alos-http to 0.0.0-20260617230736-314b6783e196 or later.
go get github.com/guno1928/alos-http@v0.0.0-20260617230736-314b6783e196Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
| 0.0.0-20260617230736-314b6783e196 |
Sources
- osv: GO-2026-6321
- nvd: CVE-2026-55484
- https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj
- https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374
CVE-2026-55484 · published · modified · JSON