An unauthenticated remote denial of service vulnerability in alos-http allows attackers to crash the server process by sending a specifically crafted request path.

This issue is caused by an uncaught exception in the sanitizeRequestPath function, where an unchecked array access occurs when processing malformed request paths starting with a question mark. An unauthenticated attacker can trigger this condition via various request handlers, causing the server process to terminate abruptly.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk primarily due to the impact on system availability. Successful exploitation results in a complete denial of service for the affected application server, which can lead to significant operational downtime and potential disruption of dependent business services.

Immediate Action: Update the alos-http library to the fixed version 0.0.0-20260617230736-314b6783e196 or later.

Proactive Monitoring: Monitor server logs for frequent application panics or sudden service restarts that may indicate attempted exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and reject malformed HTTP requests containing unusual path queries before they reach the application framework.

Public Exploit Available: No

Given the ease of exploitation and the potential for total service interruption, organizations utilizing the alos-http framework must prioritize applying the provided patch. Immediate deployment of the fix is necessary to prevent potential service instability caused by malicious or accidental malformed request traffic.