Vulnerability GO-2026-6859
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
November 11, 2026 at 02:51 AM UTC
HTTP/1 server crash due to MaxBytesReader header race in net/http
<1.26.11, >=1.27.0-0 <1.27.4
<1.26.11, >=1.27.0-0 <1.27.4
Summary
HTTP/1 server crash due to MaxBytesReader header race in net/http
Details
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
21 days ago
Distrust compromised intermediate certificates in crypto/x509
<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809
<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809
Unknown
1 month ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
1 month ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
1 month ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Unknown
1 month ago
Root.Mkdir(All) can follow junctions out of the root on Windows in os
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
Impacted packages
Timeline
Published
5 hours ago
November 11, 2026 at 02:51 AM UTC
Last Modified
5 hours ago
November 11, 2026 at 03:15 AM UTC