---
id: "CVE-2026-97054"
page: "https://infrastack.ai/live/CVE-2026-97054"
kind: "vulnerability"
aliases: ["CVE-2026-97054", "GO-2026-6859"]
title: "HTTP/1 server crash due to MaxBytesReader header race in net/http"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "stdlib", "fixed": ["1.26.11", "1.27.4"], "affected": ">= 1.27.0-0, < 1.27.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "http-server", "net-http", "runtime"]
not_affected_if: ["http2-only", "no-maxbytesreader", "sequential-body-read"]
published_at: "2026-11-11T02:51:11+00:00"
first_seen_at: "2026-11-11T03:37:17+00:00"
updated_at: "2026-11-11T03:39:03+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6859", "first_seen_at": "2026-11-11T03:37:17+00:00"}]
exploit_sources: []
---

# HTTP/1 server crash due to MaxBytesReader header race in net/http

Link for people: https://infrastack.ai/live/CVE-2026-97054 (this .md is for agents)

When a Go HTTP/1 server's MaxBytesReader limit is exceeded, the standard library sets a Connection header without synchronization, which can race with a handler setting a header. The race can cause a runtime panic that crashes the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:stdlib affected >= 1.27.0-0, < 1.27.4 fixed 1.26.11, 1.27.4

## How to check

- Run `go version` on the build machine to see the Go toolchain; the affected range is `1.27.0` up to `1.27.4`.
- Search the codebase for `http.MaxBytesReader` or `http.MaxBytesHandler` and check whether handlers read the request body while writing response headers concurrently.

## Fix

- Go `1.26.11`
- Go `1.27.4`

## Timeline

- 2026-11-11T03:37:17+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6859

## From the sources

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_