CVE-2026-97054: HTTP/1 server crash due to MaxBytesReader header race in net/http
Go standard library · net/http
Vendor fix available · Affected: Go standard library net/http · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 12 Nov.
- Go releases fix build time code execution and HTTP flawsSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.