net-http up to 1.21.11/1.22.4 on Go net/http denial of service

Summaryinfo

A vulnerability was found in net-http up to 1.21.11/1.22.4 on Go. It has been declared as problematic. The affected element is an unknown function of the file net/http. The manipulation results in denial of service. This vulnerability is identified as CVE-2024-24791. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in net-http up to 1.21.11/1.22.4 on Go. It has been classified as problematic. Affected is some unknown processing of the file net/http. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

This vulnerability is traded as CVE-2024-24791 since 01/30/2024. The exploitability is told to be easy. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 207754 (AlmaLinux 8 : container-tools:rhel8 (ALSA-2024:6969)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.21.12 or 1.22.5 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (207754). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• net-http

Version

• 1.21.0
• 1.21.1
• 1.21.2
• 1.21.3
• 1.21.4
• 1.21.5
• 1.21.6
• 1.21.7
• 1.21.8
• 1.21.9
• 1.21.10
• 1.21.11
• 1.22.0
• 1.22.1
• 1.22.2
• 1.22.3
• 1.22.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion