GO-2026-6859

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6859

Import Source

https://vuln.go.dev/ID/GO-2026-6859.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6859

Aliases

CVE-2026-97054

Published

2026-11-11T02:51:11Z

Modified

2026-11-11T03:15:14Z

Summary

HTTP/1 server crash due to MaxBytesReader header race in net/http

Details

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6859"
}

References

Credits

- Jakub Ciolek (https://ciolek.dev)

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.11

Introduced

1.27.0-0

Fixed

1.27.4

Ecosystem specific

{
    "imports": [
        {
            "path": "net/http",
            "symbols": [
                "CanonicalHeaderKey",
                "Client.CloseIdleConnections",
                "Client.Do",
                "Client.Get",
                "Client.Head",
                "Client.Post",
                "Client.PostForm",
                "ClientConn.Close",
                "ClientConn.RoundTrip",
                "Cookie.String",
                "Cookie.Valid",
                "CrossOriginProtection.AddInsecureBypassPattern",
                "CrossOriginProtection.AddTrustedOrigin",
                "CrossOriginProtection.Check",
                "Dir.Open",
                "Error",
                "Get",
                "Handle",
                "HandleFunc",
                "HandlerFunc.ServeHTTP",
                "Head",
                "Header.Add",
                "Header.Del",
                "Header.Get",
                "Header.Set",
                "Header.Values",
                "Header.Write",
                "Header.WriteSubset",
                "ListenAndServe",
                "ListenAndServeTLS",
                "NewRequest",
                "NewRequestWithContext",
                "NotFound",
                "ParseCookie",
                "ParseSetCookie",
                "ParseTime",
                "Post",
                "PostForm",
                "ProxyFromEnvironment",
                "ReadRequest",
                "ReadResponse",
                "Redirect",
                "Request.AddCookie",
                "Request.BasicAuth",
                "Request.Cookie",
                "Request.Cookies",
                "Request.CookiesNamed",
                "Request.FormFile",
                "Request.FormValue",
                "Request.MultipartReader",
                "Request.ParseForm",
                "Request.ParseMultipartForm",
                "Request.PostFormValue",
                "Request.Referer",
                "Request.SetBasicAuth",
                "Request.UserAgent",
                "Request.Write",
                "Request.WriteProxy",
                "Response.Cookies",
                "Response.Location",
                "Response.Write",
                "ResponseController.EnableFullDuplex",
                "ResponseController.Flush",
                "ResponseController.Hijack",
                "ResponseController.SetReadDeadline",
                "ResponseController.SetWriteDeadline",
                "Serve",
                "ServeContent",
                "ServeFile",
                "ServeFileFS",
                "ServeMux.Handle",
                "ServeMux.HandleFunc",
                "ServeMux.ServeHTTP",
                "ServeTLS",
                "Server.Close",
                "Server.ListenAndServe",
                "Server.ListenAndServeTLS",
                "Server.Serve",
                "Server.ServeTLS",
                "Server.SetKeepAlivesEnabled",
                "Server.Shutdown",
                "SetCookie",
                "Transport.CancelRequest",
                "Transport.Clone",
                "Transport.CloseIdleConnections",
                "Transport.NewClientConn",
                "Transport.RoundTrip",
                "body.Close",
                "body.Read",
                "bodyEOFSignal.Close",
                "bodyEOFSignal.Read",
                "bodyLocked.Read",
                "bufioFlushWriter.Write",
                "cancelTimerBody.Close",
                "cancelTimerBody.Read",
                "checkConnErrorWriter.Write",
                "chunkWriter.Write",
                "connReader.Read",
                "connectMethodKey.String",
                "expectContinueReader.Close",
                "expectContinueReader.Read",
                "extraHeader.Write",
                "fileHandler.ServeHTTP",
                "fileTransport.RoundTrip",
                "globalOptionsHandler.ServeHTTP",
                "gzipReader.Close",
                "gzipReader.Read",
                "http1ClientConn.Close",
                "http1ClientConn.RoundTrip",
                "http2ClientConn.RoundTrip",
                "http2Handler.ServeHTTP",
                "http2ResponseWriter.Flush",
                "http2ResponseWriter.FlushError",
                "http2ResponseWriter.Push",
                "http2RoundTripper.RoundTrip",
                "http3ServerHandler.ServeHTTP",
                "initALPNRequest.ServeHTTP",
                "loggingConn.Close",
                "loggingConn.Read",
                "loggingConn.Write",
                "maxBytesReader.Close",
                "maxBytesReader.Read",
                "onceCloseListener.Close",
                "persistConn.Read",
                "persistConnWriter.ReadFrom",
                "persistConnWriter.Write",
                "populateResponse.Write",
                "populateResponse.WriteHeader",
                "readTrackingBody.Close",
                "readTrackingBody.Read",
                "readWriteCloserBody.CloseWrite",
                "readWriteCloserBody.Read",
                "redirectHandler.ServeHTTP",
                "response.Flush",
                "response.FlushError",
                "response.Hijack",
                "response.ReadFrom",
                "response.Write",
                "response.WriteHeader",
                "response.WriteString",
                "serverHandler.ServeHTTP",
                "socksDialer.DialWithConn",
                "socksUsernamePassword.Authenticate",
                "stringWriter.WriteString",
                "timeoutHandler.ServeHTTP",
                "timeoutWriter.Write",
                "timeoutWriter.WriteHeader",
                "transportReadFromServerError.Error",
                "unencryptedHTTP2Request.ServeHTTP"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6859.json"