CVE-2024-24791: Denial of service due to improper 100-continue handling in net/http

What it is stated by the CNA

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

weakness

CWE 400: Uncontrolled Resource Consumption

affected

Go standard library net/http

versions

No affected-version range in held sources.

fixed in

1.21.12; 1.22.5

fixed by package (from OSV advisories)

golang (Bitnami): 1.21.12; 1.22.5 BIT-golang-2024-24791stdlib (Go): 1.21.12; 1.22.5 GO-2024-2963

later fixes (from OSV advisories)

golang 1.21.12 is inside a range CVE-2024-34155 (BIT-golang-2024-34155) lists as affected. That advisory is fixed in 1.22.7.golang 1.21.12 is inside a range CVE-2024-34156 (BIT-golang-2024-34156) lists as affected. That advisory is fixed in 1.22.7.golang 1.21.12 is inside a range CVE-2024-34158 (BIT-golang-2024-34158) lists as affected. That advisory is fixed in 1.22.7.golang 1.21.12 is inside a range CVE-2024-45336 (BIT-golang-2024-45336) lists as affected. That advisory is fixed in 1.22.11.golang 1.21.12 is inside a range CVE-2024-45341 (BIT-golang-2024-45341) lists as affected. That advisory is fixed in 1.22.11.golang 1.21.12 is inside a range CVE-2025-0913 (BIT-golang-2025-0913) lists as affected. That advisory is fixed in 1.23.10.

assigned by

Go

published

2024-07-02

check us go.dev go.dev groups.google.com pkg.go.dev

Exploit code held, dated

exploit code

None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

34 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2024-24791', '2026-10-31T23:59:59.999999Z', now());