Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: * and no authentication in github.com/xyproto/algernon

概要

参考情報

• xyproto/algernon security advisory · ADVISORY

github.com/xyproto/algernon のその他の脆弱性

• CVE-2026-52792高 8.7Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by …
• CVE-2026-48126高 8.2Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which sile…
• CVE-2026-46431中 4.3Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header w…
• CVE-2026-46430中 4.3Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default…
• CVE-2026-45728高 7.5Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a direct…