GO-2026-6609

vendorUSosv

Lack of limit on size of parsed Range headers in net/http

view advisory published 2026-10-08Licence: per source

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-78667US	—	0.48% (41st)	—	2026-10-08
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

references

External citations — patches, advisories, analysis.

https://go.dev/cl/847309FIX
https://go.dev/issue/81858REPORT
https://groups.google.com/g/golang-announce/c/U2fTuyDJznIWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan