CVE-2024-24791: Denial of service due to improper 100-continue handling in net/http
Last updated 14 November 2024
Other sources
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.
An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24791?
CVE-2024-24791 has a severity rating that indicates it can lead to denial of service.
How do I fix CVE-2024-24791?
To fix CVE-2024-24791, upgrade to golang-1.22 version 1.22.11-1 or newer.
Which products are affected by CVE-2024-24791?
CVE-2024-24791 affects IBM Concert Software versions 1.0.0 to 1.0.1 and golang versions 1.15.15-1~deb11u4 and 1.19.8-2.
What causes the vulnerability in CVE-2024-24791?
The vulnerability in CVE-2024-24791 is caused by improper handling of the 100-continue HTTP header.
Can CVE-2024-24791 be exploited remotely?
Yes, CVE-2024-24791 can be exploited remotely by sending specially crafted "Expect: 100-continue" requests.