CVE-2024-24791

Aliases:GO-2024-2963BIT-golang-2024-24791
Advisory lineage Upstream: 0 Downstream: 33
Deferred
Published: 02 Jul 2024, 21:28
Last modified:04 Oct 2024, 15:02

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.02% LOW
1% probability +0.38%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 Jul 2024, 21:28
Published
Vulnerability first disclosed
04 Oct 2024, 15:02
Last Modified
Vulnerability information updated

Description

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.02%• Percentile: 78%

Affected Systems

  • go standard library•net/http

    < 1.21.12 | ≥ 1.22.0-0, < 1.22.5

  • Go•stdlib

    ≥ 1.22.0-0, < 1.22.5

References (5)