CVE-2024-24791 Denial of service due to improper 100-continue handling in net/http

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Denial of Service Vulnerabilities in Go's net/http Module Two denial of service vulnerabilities have been identified in Go's net/http module. CVE-2022-27664, published on September 6, 2022, allows attackers to cause a denial of service due to HTTP/2 connection issues during closing. CVE-2024-24791, published on July 2, 2024, arises from improper handling of the 100-continue response. 3 sources 52