Denial of service due to improper 100-continue handling in net/http
Priority MEDIUM 42Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 32 fixed, 43 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01414 72nd percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.21.12, 1.22.5Red Hat: 39 advisoriesRed Hat: 32 fixed, 43 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | net/http | before 1.21.12; 1.22.0-0 to before 1.22.5 | 1.21.12, 1.22.5 | Patch available | CNA |
- net/http VendorGo standard library Affected before 1.21.12; 1.22.0-0 to before 1.22.5 Fixed in 1.21.12, 1.22.5 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:go_standard_library:net\/http:1.21.12:*:*:*:*:*:*:* | 1.21.12 | — | — |
- cpe:2.3:a:go_standard_library:net\/http:1.21.12:*:*:*:*:*:*:* Versions 1.21.12 — ·—
Remediation
- Fix · CNA net/http (Go standard library) Fixed in 1.21.12, 1.22.5
Red Hat 39 advisories
- RHSA-2025:11889 Released 2025-07-28 · Red Hat rating Important7.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel10, rhceph/grafana-rhel9, rhceph/keepalived-rhel9 +4
- RHSA-2025:9776 Released 2025-06-26 · Red Hat rating ImportantNew RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
- RHSA-2025:7256 Released 2025-05-13 · Red Hat rating Moderategit-lfs security update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.6.1-1.el9
Show 36 more Red Hat advisories
- RHSA-2025:3973 Released 2025-04-17 · Red Hat rating ImportantOpenShift Virtualization 4.16.7 Images
- CNV 4.16 for RHEL 9 container-native-virtualization/aaq-controller-rhel9, container-native-virtualization/aaq-operator-rhel9, container-native-virtualization/aaq-server-rhel9 +47
- RHSA-2025:2416 Released 2025-03-05 · Red Hat rating ImportantStreams for Apache Kafka 2.9.0 release and security update
- Streams for Apache Kafka 2.9.0
- RHSA-2025:0082 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2024:10906 Released 2024-12-10 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8 +1
- RHSA-2024:10758 Released 2024-12-03 · Red Hat rating ModerateOpenShift Virtualization 4.12.15 Images
- CNV 4.12 for RHEL 8 container-native-virtualization/bridge-marker, container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cnv-containernetworking-plugins +40
- RHSA-2024:10389 Released 2024-11-26 · Red Hat rating ModerateOpenShift Virtualization 4.13.11 Images
- CNV 4.13 for RHEL 9 container-native-virtualization/bridge-marker-rhel9, container-native-virtualization/cluster-network-addons-operator-rhel9, container-native-virtualization/cnv-containernetworking-plugins-rhel9 +43
- RHSA-2024:10133 Released 2024-11-21 · Red Hat rating Moderaterhc-worker-script security update
- Red Hat Enterprise Linux Server (v. 7 ELS) rhc-worker-script-0.10-2.el7_9
- RHSA-2024:9960 Released 2024-11-19 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.3.4 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-rhel9
- RHSA-2024:8219 Released 2024-11-18 · Red Hat rating ModerateSecondary Scheduler Operator for Red Hat OpenShift 1.2.2 for RHEL 9
- OSSO 1.2 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
- RHSA-2024:9097 Released 2024-11-12 · Red Hat rating Moderatebuildah security update
- Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.37.2-1.el9, buildah-tests-2:1.37.2-1.el9
- RHSA-2024:9115 Released 2024-11-12 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-4.el9, grafana-selinux-10.2.6-4.el9
- RHSA-2024:9098 Released 2024-11-12 · Red Hat rating Moderateskopeo security update
- Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.16.1-1.el9, skopeo-tests-2:1.16.1-1.el9
- RHSA-2024:9089 Released 2024-11-12 · Red Hat rating Moderatecontainernetworking-plugins security update
- Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.5.1-2.el9
- RHSA-2024:9135 Released 2024-11-12 · Red Hat rating Moderatetoolbox security update
- Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.5-5.el9, toolbox-tests-0.0.99.5-5.el9
- RHSA-2024:9102 Released 2024-11-12 · Red Hat rating Moderatepodman security update
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:5.2.2-1.el9, podman-docker-2:5.2.2-1.el9, podman-plugins-2:5.2.2-1.el9 +2
- RHSA-2024:8697 Released 2024-11-08 · Red Hat rating ImportantOpenShift Container Platform 4.14.40 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:8692 Released 2024-11-07 · Red Hat rating ImportantOpenShift Container Platform 4.12.68 security update
- Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:8688 Released 2024-11-06 · Red Hat rating ImportantOpenShift Container Platform 4.13.53 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:8425 Released 2024-10-31 · Red Hat rating ImportantOpenShift Container Platform 4.15.37 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
- RHSA-2024:8260 Released 2024-10-24 · Red Hat rating ImportantOpenShift Container Platform 4.16.18 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:8317 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 5.8.14
- RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14
- RHSA-2024:8314 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.0.1
- RHOL 6.0 for RHEL 9 openshift-logging/logging-loki-rhel9
- RHSA-2024:8318 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 5.6.25
- RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
- RHSA-2024:8315 Released 2024-10-23 · Red Hat rating ImportantLogging for Red Hat OpenShift - 5.9.8
- RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
- RHSA-2024:6341 Released 2024-10-23 · Red Hat rating ModerateKube Descheduler Operator for Red Hat OpenShift 5.1.0 for RHEL 9
- KDO 5.1 for RHEL 9 kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-operator-bundle, kube-descheduler-operator/kube-descheduler-rhel9-operator
- RHSA-2024:7922 Released 2024-10-16 · Red Hat rating ImportantOpenShift Container Platform 4.17.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:7548 Released 2024-10-16 · Red Hat rating ModerateRun Once Duration Override Operator for Red Hat OpenShift 1.2.0 for RHEL 9
- RODOO 1.2 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
- RHSA-2024:7349 Released 2024-09-30 · Red Hat rating Moderategrafana security update
- Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-18.el8_10, grafana-selinux-9.2.10-18.el8_10
- RHSA-2024:7348 Released 2024-09-30 · Red Hat rating ModerateCustom Metrics Autoscaler Operator for Red Hat 2.14.1-467 OpenShift Update
- OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
- RHSA-2024:7074 Released 2024-09-25 · Red Hat rating ModerateNetwork Observability 1.6.2 for OpenShift
- NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:6969 Released 2024-09-24 · Red Hat rating Moderatecontainer-tools:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.s390x::container-tools:rhel8 +47
- RHSA-2024:6912 Released 2024-09-23 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-2.module+el8.8.0+22004+c5f8797c.aarch64::go-toolset:rhel8 +18
- RHSA-2024:6908 Released 2024-09-23 · Red Hat rating Importantgo-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.aarch64::go-toolset:rhel8, delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.ppc64le::go-toolset:rhel8, delve-1.21.2-4.module+el8.10.0+22329+6cd5c9c6.src::go-toolset:rhel8 +19
- RHSA-2024:6913 Released 2024-09-23 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.13-3.el9_4, golang-1.21.13-3.el9_4, golang-bin-1.21.13-3.el9_4 +4
- RHSA-2024:6914 Released 2024-09-23 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) golang-1.19.13-12.el9_2, golang-bin-1.19.13-12.el9_2, golang-docs-1.19.13-12.el9_2 +4
- RHSA-2024:5537 Released 2024-08-19 · Red Hat rating ModerateRed Hat build of Cryostat security update
- Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-db-rhel8, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Builds for Red Hat OpenShift | Affected | No fix planned: Will not fix |
| Cost Management Metrics Operator | Affected | No fix yet |
| Fence Agents Remediation Operator | Affected | No fix planned: Will not fix |
| Logical Volume Manager Storage | Affected | No fix planned: Will not fix |
| Machine Deletion Remediation Operator | Affected | No fix planned: Will not fix |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| NBDE Tang Server | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| Node Maintenance Operator | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 3 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 5 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform Assisted Installer 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Service Interconnect 1 | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Web Terminal | Affected | No fix planned: Will not fix |
| Self Node Remediation Operator | Affected | No fix planned: Will not fix |
| Service Telemetry Framework 1.5 | Affected | No fix planned: Will not fix |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:10906 |
| 9Base-OADP-1.3 | Fixed | RHSA-2024:9960 |
| CNV 4.12 for RHEL 8 | Fixed | RHSA-2024:10758 |
| CNV 4.13 for RHEL 9 | Fixed | RHSA-2024:10389 |
| CNV 4.16 for RHEL 9 | Fixed | RHSA-2025:3973 |
| Cryostat 3 on RHEL 8 | Fixed | RHSA-2024:5537 |
| KDO 5.1 for RHEL 9 | Fixed | RHSA-2024:6341 |
| NETOBSERV 1.6 for RHEL 9 | Fixed | RHSA-2024:7074 |
| OSSO 1.2 for RHEL 9 | Fixed | RHSA-2024:8219 |
| OpenShift Custom Metrics Autoscaler 2 | Fixed | RHSA-2024:7348 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:0082 |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2024:8318 |
| RHOL 5.8 for RHEL 9 | Fixed | RHSA-2024:8317 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:8315 |
| RHOL 6.0 for RHEL 9 | Fixed | RHSA-2024:8314 |
| RODOO 1.2 for RHEL 9 | Fixed | RHSA-2024:7548 |
| Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | Fixed | — |
| Red Hat Ceph Storage 7.1 Tools | Fixed | RHSA-2025:11889 |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:9776 |
| Red Hat Developer Hub 1.3 for RHEL 9 | Fixed | — |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:6908, RHSA-2024:6969, RHSA-2024:7349 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:6913, RHSA-2024:9089, RHSA-2024:9097, RHSA-2024:9098, RHSA-2024:9102, RHSA-2024:9115, RHSA-2024:9135, RHSA-2025:7256 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:6912 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:6914 |
| Red Hat Enterprise Linux Server (v. 7 ELS) | Fixed | RHSA-2024:10133 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:8692 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:8688 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:8697 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:8425 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:8260 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:7922 |
| Streams for Apache Kafka 2.9.0 | Fixed | RHSA-2025:2416 |
Not affected: 18 products
- 8Base-RHMTC-1.8
- 9Base-OADP-1.3
- Migration Toolkit for Applications 7
- OSSO 1.2 for RHEL 9
- OpenShift Developer Tools and Services
- RHODF 4.16 for RHEL 9
- RHOL 6.0 for RHEL 9
- Red Hat Developer Hub 1.3 for RHEL 9
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
Timeline
- 2026-10-02 Threatist record created from CVE-2024-24791
- 2026-10-03 Alias added: GHSA-hw49-2p59-3mhj
References
More Go standard library vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
- TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
Sources
- CVE-2024-24791 · CVE Program
- CVE-2024-24791 · NVD
- FIRST EPSS
- GHSA-hw49-2p59-3mhj · GitHub Advisory Database · CC BY 4.0
- CVE-2024-24791 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences