CVE-2026-97054

UNKNOWN 0.0

HTTP/1 server crash due to MaxBytesReader header race in net/http

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Vendor	go standard library
Product	net/http
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for go standard library net/http

Be the first to know when new unknown vulnerabilities affecting go standard library net/http are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Go standard library / net/http

0 < 1.26.11 1.27.0-0 < 1.27.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

go.dev: https://go.dev/cl/862185 go.dev: https://go.dev/issue/82563 groups.google.com: https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM pkg.go.dev: https://pkg.go.dev/vuln/GO-2026-6859

Credits

Jakub Ciolek (https://ciolek.dev)