Out-of-Bounds Access Vulnerability in ALOS HTTP by Guno1928

CVE-2026-55484

What is CVE-2026-55484?

ALOS HTTP, a Go web framework, has a vulnerability where an unauthenticated client can exploit a malformed request that starts with a question mark. This situation leads to an out-of-bounds access due to unchecked path handling when processing the request. If triggered, the vulnerability causes the system to panic and terminate before the recovery middleware can intervene, risking the stability of the server. To address this issue, it is crucial for users to upgrade to version 0.0.0-20260617230736-314b6783e196 or later.

References