STDLIB · CVE-2026-97054 · Runtime
FIX → 1.27.4 +1
When a Go HTTP/1 server's MaxBytesReader limit is exceeded, the standard library sets a Connection header without synchronization, which can race with a handler setting a header. The race can cause a runtime panic that crashes the server.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Go services that use net/http for HTTP/1 serving and wrap request bodies with MaxBytesReader or MaxBytesHandler, where a handler reads the body concurrently with writing the response header. Servers that use HTTP/2 only, do not use these helpers, or do not read bodies concurrently with header writes are less exposed. unknown for exact exploitability conditions beyond the description.
Not affected if http2-only, no-maxbytesreader, sequential-body-read
Who cares go, http-server, net-http
go version on the build machine to see the Go toolchain; the affected range is 1.27.0 up to 1.27.4.http.MaxBytesReader or http.MaxBytesHandler and check whether handlers read the request body while writing response headers concurrently.For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.27.4 +1
1.26.111.27.4