CVE-2026-55484

ALOS HTTP, a Linux-first Go web framework and application server built on a custom networking stack, has a flaw in core/utils.go::sanitizeRequestPath that can crash the server process on a malformed request path. When a request path begins with a question mark, the call to splitPathQuery can yield an empty path, and the subsequent unchecked p[0] access triggers an out-of-bounds panic before the core.Recovery() middleware runs, so the panic is uncaught. An unauthenticated attacker can trigger this remotely via HTTP/1.1 request parsing (ParseH1RequestHead), HTTP/2 HPACK header decoding, or HTTP/3 request handling by sending a path such as a lone question mark, resulting in termination of the server process (availability loss only, per the CVSS 7.5 score). Any service built on ALOS HTTP versions prior to pseudo-version 0.0.0-20260617230736-314b6783e196 and accepting inbound requests directly is affected. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS assigns roughly a 0.3% probability of exploitation within 30 days.

What to do: Update the ALOS HTTP dependency to pseudo-version 0.0.0-20260617230736-314b6783e196 or later (check go.mod/go.sum for vulnerable versions and rebuild). Where upgrading is not immediately possible, place a fronting reverse proxy that rejects or normalizes request paths beginning with a question mark, and note that application-level core.Recovery() middleware does not mitigate this since the panic occurs before it runs. Inventory any internet-facing services built on ALOS HTTP, as direct exposure to untrusted clients is the attack vector.