CVE-2024-24791: Denial of Service in net/http package
Summary
CVE-2024-24791: The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. Affects golang-1.15 versions 1.15.15-1 – 1.15.9-6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package is a standard library in the Go programming language. It provides a collection of packages that offer fundamental functionality for building Go applications. The net/http package within stdlib is responsible for handling HTTP requests and responses. It is widely used for creating web servers and clients.
Vulnerability Detail
The net/http package in stdlib mishandles the case where a server responds to a request with an 'Expect: 100-continue' header with a non-informational (200 or higher) status. This mishandling can lead to an invalid state in the client connection, causing subsequent requests to fail. An attacker can exploit this vulnerability by sending 'Expect: 100-continue' requests to a net/http/httputil.ReverseProxy proxy, eliciting non-informational responses from the backend. Each request leaves the proxy with an invalid connection, resulting in a denial of service (DoS) attack.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the stdlib package to the fixed versions.
Conclusion
The net/http package in the stdlib is vulnerable to a denial of service attack due to improper handling of 'Expect: 100-continue' headers. Developers should update to the fixed versions (1.21.12 or 1.22.5) to mitigate the risk of exploitation.
See every vulnerability recorded for golang-1.15 →
FAQ
The vulnerability can be exploited by an attacker to launch a denial of service attack, causing affected applications to become unresponsive.
The vulnerability exists in version 1.18.7 of the stdlib package. Versions 1.21.12 and 1.22.5 have been released to address the issue.
There is no known public exploit for this vulnerability at the time of this report.
The only effective mitigation is to update the stdlib package to the fixed versions.
Yes, this vulnerability can be exploited remotely by sending malicious requests to a vulnerable application.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang-1.15.
