CVE-2024-24791 — Denial of service due to improper 100-continue handling in net/http

Affected: Go standard library net/http, go_standard_library net\/http

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

USN-7081-1 — golang-1.22 vulnerabilities

Affected: Ubuntu:20.04:LTS: golang-1.22, Ubuntu:22.04:LTS: golang-1.22, Ubuntu:24.04:LTS: golang-1.22

It was discovered that the Go net/http module did not properly handle responses to requests with an "Expect: 100-continue" header under certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-24791)

It was discovered that the Go parser module did not properly handle deeply nested literal values. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34155)

It was discovered that the Go encoding/gob module did not properly handle message decoding under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34156)

It was discovered that the Go build module did not properly handle certain build tag lines with deeply nested expressions. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34158)

Most recent entries from all

CVE-2024-24791 — Denial of service due to improper 100-continue handling in net/http

USN-7081-1 — golang-1.22 vulnerabilities