Executive brief
alos-http is a high-performance Go HTTP server framework. A single unauthenticated HTTP request with a malformed path crashes the entire server process, disconnecting all active connections and preventing new requests until the service is restarted. An attacker can repeatedly send this trivial request to keep the service offline, resulting in complete unavailability.
Technical details
The vulnerability is a bounds-check bypass in the sanitizeRequestPath function (core/utils.go:566). When an HTTP request arrives with a path consisting only of "?" (query string prefix), the function fails to validate the path is non-empty after stripping query parameters. The code checks if the raw path is empty, then calls splitPathQuery which returns an empty string, then immediately indexes p[0] without a length check. This triggers a panic ("index out of range") in the connection-worker goroutine before the handler chain executes. Since the panic occurs below the core.Recovery() middleware layer, it crashes the entire process. The vulnerability is reachable via HTTP/1.1 (ParseH1RequestHead), HTTP/2 (hpack.go), and HTTP/3 (h3_conn.go). No authentication or user interaction is required; the attack vector is network-based.
Affected products
- guno1928 alos-http < 0.0.0-20260617230736-314b6783e196
Timeline
- 2026-06-20: disclosed
- 2026-06-17: patched: Patch released as version 0.0.0-20260617230736-314b6783e196
- 2026-08-28: advisory: GitHub Security Advisory published