Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-78667

Lack of limit on size of parsed Range headers in net/http

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.26.9affected
  • 1.27.0-0 to < 1.27.2affected

References