net/http: Denial of service due to improper 100-continue handling in net/http

🗓️ 24 Sep 2024 03:30:02Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

The net/http module mishandles 100-continue, risking invalid connections and denial of service.

Reporter	Title	Published	Views	Family All 1035
RedhatCVE	CVE-2024-24791	4 Jul 202417:21	–	redhatcve
RedHat Linux	Moderate: Red Hat Security Advisory: toolbox security update	12 Nov 202409:05	–	redhat
RedHat Linux	net/http: Denial of service due to improper 100-continue handling in net/http	12 Nov 202409:05	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.4 security and bug fix update	19 Nov 202401:54	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update	8 Jan 202511:31	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: 7.1 container image is now available in the Red Hat Ecosystem Catalog.	28 Jul 202510:55	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: Streams for Apache Kafka 2.9.0 release and security update	5 Mar 202520:59	–	redhat
RedHat Linux	net/http: Denial of service due to improper 100-continue handling in net/http	5 Mar 202520:59	–	redhat
RedHat Linux	Important: Red Hat Security Advisory: OpenShift Virtualization 4.16.7 Images	17 Apr 202504:08	–	redhat
RedHat Linux	Moderate: Red Hat Security Advisory: git-lfs security update	13 May 202508:49	–	redhat

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8.10	aarch64	aardvark-dns	2:1.10.0-1.module+el8.10.0+22283+6d6d094a	aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.aarch64.rpm
Red Hat Enterprise Linux	8.10	ppc64le	aardvark-dns	2:1.10.0-1.module+el8.10.0+22283+6d6d094a	aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.ppc64le.rpm
Red Hat Enterprise Linux	8.10	s390x	aardvark-dns	2:1.10.0-1.module+el8.10.0+22283+6d6d094a	aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.s390x.rpm
Red Hat Enterprise Linux	8.10	x86_64	aardvark-dns	2:1.10.0-1.module+el8.10.0+22283+6d6d094a	aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.x86_64.rpm
Red Hat Enterprise Linux	8.10	aarch64	buildah	2:1.33.8-4.module+el8.10.0+22283+6d6d094a	buildah-2:1.33.8-4.module+el8.10.0+22283+6d6d094a.aarch64.rpm
Red Hat Enterprise Linux	8.10	ppc64le	buildah	2:1.33.8-4.module+el8.10.0+22283+6d6d094a	buildah-2:1.33.8-4.module+el8.10.0+22283+6d6d094a.ppc64le.rpm
Red Hat Enterprise Linux	8.10	s390x	buildah	2:1.33.8-4.module+el8.10.0+22283+6d6d094a	buildah-2:1.33.8-4.module+el8.10.0+22283+6d6d094a.s390x.rpm
Red Hat Enterprise Linux	8.10	x86_64	buildah	2:1.33.8-4.module+el8.10.0+22283+6d6d094a	buildah-2:1.33.8-4.module+el8.10.0+22283+6d6d094a.x86_64.rpm
Red Hat Enterprise Linux	8.10	aarch64	buildah-debuginfo	2:1.33.8-4.module+el8.10.0+22283+6d6d094a	buildah-debuginfo-2:1.33.8-4.module+el8.10.0+22283+6d6d094a.aarch64.rpm
Red Hat Enterprise Linux	8.10	ppc64le	buildah-debuginfo	2:1.33.8-4.module+el8.10.0+22283+6d6d094a	buildah-debuginfo-2:1.33.8-4.module+el8.10.0+22283+6d6d094a.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-24791
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
go	www.go.dev/cl/591255
go	www.go.dev/issue/67555
groups	www.groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-24791
cve	www.cve.org/CVERecord

19 Jul 2026 01:29Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.01414

SSVC

net/http module one hundred continue invalid connections denial of service