AZL-113480
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113480.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113480
- Upstream
- CVE-2026-97054
- Published
- 2026-11-11T05:19:58Z
- Modified
- 2026-11-13T14:17:22Z
- Summary
- CVE-2026-97054 affecting package golang 1.27.4-1
- Details
-
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
- References