—

GO-2026-6321

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http

Quick fix

GO-2026-6321 — github.com/guno1928/alos-http: upgrade to the fixed version with the command below.

go get github.com/guno1928/alos-http@v0.0.0-20260617230736-314b6783e196

Details

alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server in github.com/guno1928/alos-http

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/guno1928/alos-http

Introduced in: 0Fixed in: 0.0.0-20260617230736-314b6783e196

Fixgo get github.com/guno1928/alos-http@v0.0.0-20260617230736-314b6783e196

References

https://github.com/guno1928/alos-http/security/advisories/GHSA-hr6j-w4mw-g9mj[ADVISORY]
https://github.com/guno1928/alos-http/commit/314b6783e19698c85ea9d9b197ff52f7f6a3a374[FIX]