CVE-2024-24791

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

• https://go.dev/cl/591255
• https://go.dev/issue/67555
• https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ
• https://pkg.go.dev/vuln/GO-2024-2963
• https://go.dev/cl/591255
• https://go.dev/issue/67555
• https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ
• https://pkg.go.dev/vuln/GO-2024-2963
• https://security.netapp.com/advisory/ntap-20241004-0004/

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24786The protojson.Unmarshal function can enter an infinite loop …7.5
• CVE-2024-24787On Darwin, building a Go module which contains CGO can trigg…6.4
• CVE-2024-24788A malformed DNS message in response to a query can cause the…5.9
• CVE-2024-24789The archive/zip package's handling of certain types of inval…5.5
• CVE-2024-2479A vulnerability classified as problematic has been found in …3.5
• CVE-2024-24790The various Is methods (IsPrivate, IsLoopback, etc) did not …9.8
• CVE-2024-24792Parsing a corrupt or malicious image with invalid color indi…7.5
• CVE-2024-24793A use-after-free vulnerability exists in the DICOM Element P…9.8
• CVE-2024-24794A use-after-free vulnerability exists in the DICOM Element P…9.8
• CVE-2024-24795HTTP Response splitting in multiple modules in Apache HTTP S…6.3
• CVE-2024-24796Deserialization of Untrusted Data vulnerability in MagePeopl…8.8
• CVE-2024-24797Deserialization of Untrusted Data vulnerability in G5Theme E…9.8