---
id: "CVE-2026-78667"
kind: "vulnerability"
aliases: ["CVE-2026-78667", "GO-2026-6609"]
title: "Lack of limit on size of parsed Range headers in net/http"
severity: "high"
cvss: 7.5
epss: 0.00379
exploited: false
status: "open"
category: "runtime"
products: [{"name": "stdlib", "fixed": ["1.26.9", "1.27.2"], "affected": ">= 1.27.0-0, < 1.27.2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "http-servers", "runtime", "self-hosted"]
not_affected_if: ["behind-proxy-that-rejects-range", "no-file-serving", "static-export"]
published_at: "2026-10-08T22:31:09+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:56:01+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6609", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-78667", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Lack of limit on size of parsed Range headers in net/http

Go's net/http standard library does not limit how many ranges it parses from a Range header, so a crafted request with many small ranges makes FileServer, ServeContent and ServeFile use excessive CPU. An attacker can exhaust server CPU with ordinary HTTP requests to any endpoint serving files this way.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:stdlib affected >= 1.27.0-0, < 1.27.2 fixed 1.26.9, 1.27.2

## How to check

Run 'go version' on the build machine and check the binary's Go version with 'go version -m <binary>'.
Flag versions >= 1.27.0-0 and < 1.27.2, and 1.26.x below 1.26.9, as affected.
Check whether the service uses http.FileServer, http.ServeContent or http.ServeFile and is reachable from untrusted clients.

## Fix

Upgrade the Go toolchain to 1.26.9 or 1.27.2 and rebuild the binaries.
If an upgrade is not possible now, limit request header size and rate-limit requests at a proxy in front of the service.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6609
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-78667
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78667

## From the sources

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_