Live › vulnerability › CVE-2026-78667
Go to dashboardGo's net/http standard library does not limit how many ranges it parses from a Range header, so a crafted request with many small ranges makes FileServer, ServeContent and ServeFile use excessive CPU. An attacker can exhaust server CPU with ordinary HTTP requests to any endpoint serving files this way.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| stdlib | go | >= 1.27.0-0, < 1.27.2 | 1.26.9, 1.27.2 |
go version on the build machine and check the binarys Go version with go version -m <binary>'1.27.0-0 and < 1.27.2, and 1.26.x below 1.26.9, as affected1.26.9 or 1.27.2 and rebuild the binariesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
This page as .md · .json · in your agent: get_signal("CVE-2026-78667")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.