VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 2, 2024· Updated Apr 15, 2026

CVE-2024-24791

CVE-2024-24791

Description

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The net/http client's improper handling of 100-continue responses can leave connections in an invalid state, enabling denial of service against ReverseProxy proxies.

Vulnerability

The net/http HTTP/1.1 client mishandles the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. When the client receives such a response, it fails to properly finalize the connection state, leaving it in an invalid condition where the next request sent on the same connection will fail [1][2].

Exploitation

An attacker can exploit this by sending requests to a net/http/httputil.ReverseProxy proxy that trigger a non-informational response from the backend. Each malicious request corrupts the proxy's connection to the backend, causing one subsequent request using that connection to fail [2][3]. The attacker does not need to control the backend; they only need to influence the proxy's request flow.

Impact

Successful exploitation leads to a denial of service (DoS) condition. The proxy becomes unable to reuse connections, degrading performance and potentially blocking legitimate requests. While each attack only corrupts a single connection, repeated attacks can exhaust connection pools [1][3].

Mitigation

The vulnerability is fixed in Go versions 1.22.5 and 1.21.12 [2]. Users of Go's net/http package or ReverseProxy are advised to update immediately. No workaround is available.

References
  1. net/http: `expect: 100-continue` handling is broken in various ways
  2. [security] Go 1.22.5 and Go 1.21.12 are released
  3. GO-2024-2963 - Go Packages

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2165

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.