Unauthenticated Remote Denial of Service in alos-http

The alos-http web framework is susceptible to a remote denial-of-service vulnerability (CVE-2026-55484) due to improper input validation in the 'sanitizeRequestPath' function. When the framework receives an HTTP request with a path starting with the '?' character (e.g., 'GET ? HTTP/1.1'), the internal request parser passes the path to 'sanitizeRequestPath'. This function attempts to index the first byte of the path after query string stripping without verifying that the resulting string is non-empty. This results in an out-of-bounds panic. Because this parsing occurs in the connection-worker goroutine before any user-defined middleware or recovery handlers are executed, the panic is unrecoverable, leading to an immediate process crash. This affects HTTP/1.1, HTTP/2, and HTTP/3 protocols, potentially rendering services unavailable until restarted.

Attack Chain

1. Attacker crafts a malicious HTTP request with a malformed path starting with a '?' character.
2. Attacker transmits the request via TCP (HTTP/1.1 or HTTP/2) or UDP (HTTP/3) to the target alos-http server.
3. The server's connection-worker goroutine receives the request head.
4. The request parser invokes 'sanitizeRequestPath' with the malicious path.
5. The 'sanitizeRequestPath' function strips the query string, resulting in an empty string.
6. The function attempts to access the first index of the empty string.
7. A runtime panic triggers due to an out-of-bounds index access.
8. The entire server process crashes, resulting in total service denial.

Impact

Successful exploitation results in an immediate and total denial of service for the target application. Because the crash occurs during the request parsing phase before any request logging or middleware execution, the impact is consistent across all deployments using the vulnerable framework versions. The vulnerability has been confirmed in alos-http versions prior to 0.0.0-20260617230736-314b6783e196.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Upgrade the alos-http framework to version 0.0.0-20260617230736-314b6783e196 or later immediately to patch CVE-2026-55484.
• Deploy the provided Sigma rule to web application firewalls or reverse proxies to block requests where the URI path begins with a '?' character.
• Monitor webserver access logs for anomalous 400-series status codes or service-level process restarts that lack associated handler logs, which may indicate crash attempts.