{"id":"CVE-2026-78667","kind":"vulnerability","aliases":["CVE-2026-78667","GO-2026-6609"],"related":[],"title":"Lack of limit on size of parsed Range headers in net/http","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.","summary":"Go's net/http standard library does not limit how many ranges it parses from a Range header, so a crafted request with many small ranges makes FileServer, ServeContent and ServeFile use excessive CPU. An attacker can exhaust server CPU with ordinary HTTP requests to any endpoint serving files this way.","severity":"high","cvss":7.5,"epss":0.00379,"exploited":false,"exploited_at":null,"products":[{"name":"stdlib","fixed":["1.26.9","1.27.2"],"affected":">= 1.27.0-0, < 1.27.2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","http-servers","runtime","self-hosted"],"not_affected_if":["behind-proxy-that-rejects-range","no-file-serving","static-export"],"how_to_check":"Run 'go version' on the build machine and check the binary's Go version with 'go version -m <binary>'.\nFlag versions >= 1.27.0-0 and < 1.27.2, and 1.26.x below 1.26.9, as affected.\nCheck whether the service uses http.FileServer, http.ServeContent or http.ServeFile and is reachable from untrusted clients.","fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the binaries.\nIf an upgrade is not possible now, limit request header size and rate-limit requests at a proxy in front of the service.","status":"open","published_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:56:01+00:00","updated_at":"2026-10-23T19:56:01+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T19:56:01Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the binaries.\nIf an upgrade is not possible now, limit request header size and rate-limit requests at a proxy in front of the service.","summary":"Go's net/http standard library does not limit how many ranges it parses from a Range header, so a crafted request with many small ranges makes FileServer, ServeContent and ServeFile use excessive CPU. An attacker can exhaust server CPU with ordinary HTTP requests to any endpoint serving files this way.","category":"runtime","who_cares":["go","self-hosted","http-servers"],"confidence":0.8,"analyst_note":"","how_to_check":"Run 'go version' on the build machine and check the binary's Go version with 'go version -m <binary>'.\nFlag versions >= 1.27.0-0 and < 1.27.2, and 1.26.x below 1.26.9, as affected.\nCheck whether the service uses http.FileServer, http.ServeContent or http.ServeFile and is reachable from untrusted clients.","needs_analyst":false,"not_affected_if":["static-export","no-file-serving","behind-proxy-that-rejects-range"],"severity_if_unknown":"unknown"},"cost_usd":0.000423,"input_tokens":2076,"output_tokens":431,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A,19A '-6609':17A '-78667':14A,20A 'amount':102C 'attack':64B 'consum':99C 'contain':85C 'cpu':62B,68B,104C 'craft':49B 'cve':12A,18A 'endpoint':75B 'excess':61B,101C 'exhaust':66B 'file':77B 'fileserv':56B,92C 'fs':93C,97C 'go':15A,22B,30B 'header':9A,46B,84C 'host':29B 'http':24B,71B 'http-server':23B 'lack':1A 'larg':87C 'librari':34B 'limit':3A,37B 'make':55B 'mani':39B,52B 'net/http':11A,32B 'number':88C 'ordinari':70B 'pars':7A,42B,81C 'rang':8A,40B,45B,54B,83C,91C 'request':50B,72B 'runtim':26B 'self':28B 'self-host':27B 'serv':76B 'servecont':57B,94C 'servefil':59B,96C 'server':25B,67B 'size':5A 'small':53B,90C 'standard':33B 'stdlib':21A 'use':60B 'way':79B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-08T22:31:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6609","url":"https://pkg.go.dev/vuln/GO-2026-6609","severity":null,"published_at":"2026-10-08T22:31:09+00:00","modified_at":"2026-10-08T22:31:09+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-78667","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-78667","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-78667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","severity":null,"published_at":"2026-10-08T23:17:03+00:00","modified_at":"2026-10-09T17:16:49+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}