CVE-2024-24791: Denial of service due to improper 100-continue handling in net/http

Deferred

AliasesMGASA-2024-0261SUSE-SU-2024:2294-1SUSE-SU-2024:2295-1+1107 more

Published 02-07-2024Last modified 04-10-2024

Vulnerability summary

CVE-2024-24791 is a high (CVSS 7.5) vulnerability in go standard library net/http. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.41%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 695

OPENSUSE-SU-2024:14198-1 RHSA-2024:10133 RHSA-2024:6908 RHSA-2024:6912 RHSA-2024:6913 RHSA-2024:6914+94 more

Showing 100 of 708.

Timeline

02-07-2024
PublishedVulnerability first disclosed.
04-10-2024
Last modifiedVulnerability information updated.

Description

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

CVSS metrics

6 scores · 6 sources · 1 version

v3.17.5

EPSS trend

Probability

1.41%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r15
actions-runner-controller< 0.9.3-r1
actions-runner-controller-fips< 0.9.3-r1
addon-resizer< 1.8.22-r1
addon-resizer-fips< 1.8.22-r1

age< 1.2.0-r1
amass< 4.2.0-r12
argo-workflows< 3.6.5-r2
atlantis< 0.28.3-r1
atlantis-fips< 0.28.3-r2
authservice< 1.0.1-r1
authservice-fips< 1.0.1-r1
aws-ebs-csi-driver< 1.32.0-r1
aws-efs-csi-driver< 2.0.5-r1
aws-efs-csi-driver-fips< 1.7.0-r12
aws-flb-cloudwatch< 1.9.4-r12
aws-flb-firehose< 1.7.2-r12
aws-flb-kinesis< 1.10.2-r13
aws-load-balancer-controller< 2.8.1-r2
aws-load-balancer-controller-fips< 2.8.1-r1
aws-network-policy-agent< 1.1.2-r1
azcopy-fips< 10.25.1-r1
azure-aad-pod-identity-mic< 1.8.17-r11
bank-vaults< 1.20.4-r17
bank-vaults-fips< 1.20.4-r14
bazelisk< 1.20.0-r4
bom< 0.6.0-r7
boring-registry< 0.14.0-r4
boring-registry-fips< 0.14.0-r6
buf< 1.34.0-r1
buildah< 1.36.0-r2
caddy< 2.8.4-r2
caddy-fips< 2.8.4-r2
cadvisor< 0.49.1-r9
cadvisor-fips< 0.49.1-r8
capslock< 0.2.3-r1
cass-operator< 1.21.1-r1
cass-operator-fips-no-pvc-delete< 1.21.1-r1
cert-exporter< 2.12.0-r7
cert-exporter-fips< 2.12.0-r8
cert-manager-cmctl< 2.1.0-r1
cert-manager-cmctl-fips< 2.1.0-r1
cert-manager-webhook-pdns< 2.5.1-r5
cert-manager-webhook-pdns-fips< 2.5.1-r6
certificate-transparency< 1.2.1-r2
certificate-transparency-fips< 1.2.1-r2
cfssl< 1.6.5-r8
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r3
chartmuseum-fips< 0.16.2-r1
cilium-1.15< 1.15.6-r1
cilium-cli< 0.16.11-r1
cilium-fips-1.15< 1.15.6-r1
cloud-sql-proxy-fips< 2.11.4-r1
cloudflared< 2024.1.0-r12
cloudnative-pg< 1.23.2-r5
cloudnative-pg-fips< 1.23.2-r4
cluster-proportional-autoscaler< 1.8.11-r8
cni-plugins< 1.5.1-r1
cni-plugins-fips< 1.5.1-r1
configmap-reload< 0.13.1-r1
configmap-reload-fips< 0.12.0-r9
configmap-reload-fips-0.11< 0.11.1-r10
confluent-common-docker< 7.6.0-r7
conftest< 0.53.0-r2
conftest-fips< 0.53.0-r2
controller-gen< 0.15.0-r6
cortex< 1.17.1-r3
cortex-fips< 1.17.1-r5
cosign< 2.2.4-r8
cosign-fips< 2.2.4-r6
crane< 0.19.2-r2
cri-tools< 1.30.0-r4
croc< 10.0.9-r1
crossplane-provider-aws< 1.8.0-r1
crossplane-provider-azure< 1.1.0-r5
ctop< 0.7.7-r16
cue< 0.9.2-r1
cue-fips< 0.9.2-r1
dagdotdev< 0.0.3-r2
dagger< 0.11.9-r1
dask-gateway< 2024.1.0-r7
dataplaneapi< 2.9.4-r1
dataplaneapi-fips< 2.9.4-r1
dbmate< 2.18.0-r1
delve< 1.22.1-r6
dex< 2.40.0-r2
dex-fips< 2.40.0-r2
dex-k8s-authenticator< 1.4.0-r11
dgraph< 24.0.0-r1
direnv< 2.34.0-r5
dive< 0.12.0-r9
docker-compose< 2.28.1-r1
docker-credential-acr-env< 0.7.0-r14
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.8.0-r2
docker-credential-gcr< 2.1.22-r7
dockerize< 0.7.0-r10
dockerize-fips< 0.7.0-r10
doppler-kubernetes-operator< 1.5.1-r3
dynamic-localpv-provisioner< 4.0.0-r5
eksctl< 0.183.0-r1
envoy-ratelimit< 0.0.0_git20250317-r0
envoy-ratelimit-fips< 0.0_git20231206-r9
esbuild< 0.23.0-r1
esbuild-fips< 0.23.0-r1
etcd-3.4< 3.4.33-r1
etcd-3.5< 3.5.14-r2
etcd-fips-3.4< 3.4.33-r1
etcd-fips-3.5< 3.5.14-r1
external-secrets-fips< 0.9.19-r3
extism< 1.5.2-r1
falcoctl< 0.8.0-r4
falcoctl-fips< 0.8.0-r4
falcoctl-fips-0.4< 0.4.0-r11
falcosidekick< 2.29.0-r1
falcosidekick-fips< 2.29.0-r0
ferretdb< 1.22.0-r1
flannel< 0.25.4-r1
flannel-cni-plugin< 1.5.1-r1
fluent-bit-plugin-loki< 3.0.0-r4
fluent-operator< 2.9.0-r2
fluent-operator-fips< 2.9.0-r2
flux< 2.3.0-r4
flux-helm-controller< 1.0.1-r4
flux-image-automation-controller< 0.38.0-r5
flux-image-reflector-controller< 0.32.0-r5
flux-kustomize-controller< 1.3.0-r6
flux-notification-controller< 1.3.0-r5
flux-source-controller< 1.3.0-r5
flyte< 1.12.0-r4
fulcio< 1.4.5-r6
fulcio-fips< 1.4.5-r7
fuse-overlayfs-snapshotter< 1.0.8-r11
fzf< 0.53.0-r1
gcsfuse< 1.4.2-r9
gh< 2.52.0-r2
ghaudit< 0.4.0-r5
git-lfs< 3.5.1-r7
git-lfs-fips< 3.5.1-r2
gitleaks< 8.18.4-r1
gitness< 3.0.0_beta6-r5
gitsign< 0.10.2-r4
gke-gcloud-auth-plugin< 0.0.2-r12
glab< 1.42.0-r1
go-1.20All versions (No fix recorded)
go-1.21< 1.21.12-r0
go-1.22< 1.22.5-r0
go-bindata< 3.1.3-r22
go-licenses< 1.6.0-r15
go-md2man< 2.0.4-r5
gobump< 0.7.7-r4
gobuster< 3.6.0-r13
golangci-lint< 1.59.1-r1
gomplate< 4.0.1-r1
gomplate-fips< 4.0.1-r1
gops< 0.3.28-r12
goreleaser< 2.0.1-r3
gostatsd< 28.3.0-r5
gosu< 1.17-r7
gosu-1.11< 1.11-r2
gosu-fips< 1.17-r7
gotenberg< 8.7.0-r2
govulncheck< 1.0.2-r6
gpu-feature-discovery< 0.8.2-r3
grafana-agent-operator< 0.41.1-r2
grafana-mimir< 2.12.0-r4
grafana-operator-fips< 5.9.2-r2
grpc-health-probe-fips< 0.4.28-r1
grpcurl< 1.9.1-r5
grype< 0.79.2-r1
guac< 0.7.2-r4
haproxy-ingress< 0.14.7-r1
harbor-2.11< 2.11.0-r1
harbor-cli< 0.0.1-r4
harbor-fips-2.11< 2.11.0-r1
harbor-registry< 3.0.0_alpha1-r6
harbor-registry-fips< 3.0.0_alpha1-r6
harbor-scanner-trivy< 0.31.3-r2
harbor-scanner-trivy-fips< 0.31.3-r2
hello-world-golang< 1.3-r5
helm< 3.15.2-r1
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-docs< 1.13.1-r2
helm-fips< 3.15.2-r1
helm-fips-3< 3.19.2-r0
helm-fips-4< 4.0.1-r1
helm-operator< 1.35.0-r1
helm-operator-fips< 1.35.0-r1
helm-push< 0.10.4-r12
hey< 0.1.4-r15
hivemind< 1.1.0-r2
http-echo< 1.0.0-r8
hubble< 0.13.5-r2
hubble-fips< 0.13.5-r2
hubble-ui< 0.13.1-r3
hubble-ui-backend-fips< 0.13.1-r3
hugo< 0.128.1-r1

Show all 199

Alpine1 product

go< 1.22.5-r0

2 vendors · 200 products · Showing 200 of 923

References

29 links

go.dev/cl/591255ARTICLEREPORTFIX
go.dev/issue/67555ARTICLEREPORT
groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJARTICLEREPORTWEB
pkg.go.dev/vuln/GO-2024-2963REPORT
security.netapp.com/advisory/ntap-20241004-0004/
advisories.mageia.org/MGASA-2024-0261.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=33380REPORT
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/2024/suse-su-20242294-1/Advisory
bugzilla.suse.com/1212475REPORT

Show all 29 references

bugzilla.suse.com/1227314REPORT
www.suse.com/security/cve/CVE-2024-24791WEB
www.suse.com/support/update/announcement/2024/suse-su-20242295-1/Advisory
bugzilla.suse.com/1218424REPORT
www.suse.com/support/update/announcement/2024/suse-su-20242308-1/Advisory
www.suse.com/support/update/announcement/2024/suse-su-20242309-1/Advisory
access.redhat.com/errata/RHSA-2024:7349Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2295310REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7349.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-24791REPORT
www.cve.org/CVERecord?id=CVE-2024-24791AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-24791AdvisoryOval
ubuntu.com/security/CVE-2024-24791REPORT
ubuntu.com/security/notices/USN-7081-1Advisory
ubuntu.com/security/notices/USN-7109-1Advisory
ubuntu.com/security/notices/USN-7111-1Advisory
security-tracker.debian.org/tracker/CVE-2024-24791Advisory
security.alpinelinux.org/vuln/CVE-2024-24791Advisory