CVE-2026-78667

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-09

Assigner: Go Project

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-09

EPSS Evaluated

2026-10-18

NVD

CVE-2026-78667

EUVD

EUVD-2026-95424

Affected Vendors & Products

Vendor	Product	Version / Range
Go	standard	library net/http 0
Go	standard	library net/http 1.27.0-0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves excessive CPU consumption when parsing a Range header with many small ranges in Go's FileServer, ServeContent, and ServeFile functions. This can lead to performance degradation or denial of service.

Detection Guidance

This vulnerability involves excessive CPU consumption when parsing Range headers with many small ranges. To detect it, monitor CPU usage spikes during HTTP requests with Range headers. Check server logs for repeated requests with unusual Range header patterns. Use tools like 'top' or 'htop' to observe CPU load during such requests.

Impact Analysis

It can cause high CPU usage, slow down or crash your server, and disrupt normal operations if exploited by sending malicious Range headers.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to CPU resource exhaustion rather than data privacy or security controls.

Mitigation Strategies

Update to a patched version of Go that fixes this issue in the net/http package. Monitor CPU usage on servers running FileServer, ServeContent, or ServeFile for unusual spikes.

Hi! I’m here to help you understand CVE-2026-78667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70