The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
Affected component
The vulnerability is in pkg:golang/stdlib@1.22.3, detected by the container-scanning scan.
Recommended fix
Upgrade to version 1.22.5 or later.
Risk: 2.60 (Low)
EPSS: 0.04 %
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
Exploit: Not available
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability.
Vulnerability Depth: 1
The vulnerability is in a direct dependency of your project.
CVSS-BE: 5.7
Exploiting this vulnerability significantly impacts availability.
CVSS-B: 7.5
The vulnerability can be exploited over the network without needing physical access.
It is easy for an attacker to exploit this vulnerability.
An attacker does not need any special privileges or access rights.
No user interaction is needed for the attacker to exploit this vulnerability.
The impact is confined to the system where the vulnerability exists.
There is a high impact on the availability of the system.
CVE-2024-24791
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
Affected component
The vulnerability is in
pkg:golang/stdlib@1.22.3, detected by thecontainer-scanningscan.Recommended fix
Upgrade to version 1.22.5 or later.
Risk:
2.60 (Low)EPSS:
0.04 %The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
Exploit:
Not availableWe did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database. There are no script kiddies exploiting this vulnerability.
Vulnerability Depth:
1The vulnerability is in a direct dependency of your project.
CVSS-BE:
5.7CVSS-B:
7.5More details can be found in DevGuard
We need to update to 1.22.5 - this will resolve all open cves. Should be pretty simple in the Dockerfile.