CVE-2024-24791
mediumPriorität · verfolgen · 0EPSS 0.014 · 73. PerzentilDEEUNLRUUSEPSS · bewertet 2026-10-27
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.9–7.5
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (43)
Betroffene Produkte und Versionsbereiche.
- Dell PowerProtect Data Domain Management Centeralle Versionencert_bundDEcpe:/a:dell:powerprotect_data_domain_management_center:-
- Red Hat Enterprise Linux Cryostat 3alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:cryostat_3
- Red Hat OpenShift API for Data Protection 1alle Versionencert_bundDEcpe:/a:redhat:openshift:api_for_data_protection_1
- Red Hat OpenShift Kube Descheduler Operator 5alle Versionencert_bundDEcpe:/a:redhat:openshift:kube_descheduler_operator_5
Advisories (5)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0020Kwetsbaarheden verholpen in Oracle Database productenNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse database producten en subsystemen, zoals de Core Database, Graal, Application Express, GoldenGate en REST data.
- NCSC-2025-0021Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in zijn Communicatieproducten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Network Function en Oracle Communications Order and Service Management.
- WID-SEC-W-2024-1505Golang Go: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-07-02csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-golang-2024-24791Denial of service due to improper 100-continue handling in net/http2024-07-04vendor · osvUS
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
- GO-2024-2963Denial of service due to improper 100-continue handling in net/http2024-07-02vendor · osvUS
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202407-266cnnvd
- EUVD-2024-22168enisa_euvd
- BDU:2024-06680fstec_bdu
- GHSA-hw49-2p59-3mhjenisa_euvd
- BIT-golang-2024-24791osv
- GO-2024-2963osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2024-24791cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-24791/cnnvd
- https://go.dev/cl/591255cnnvd
- https://go.dev/issue/67555cnnvd
- https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJcnnvd
- https://pkg.go.dev/vuln/GO-2024-2963cnnvd
- https://go.dev/cl/591255enisa_euvd
- https://go.dev/issue/67555enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan