CVE-2026-78667— Lack of limit on size of parsed Range headers in net/http
Quick assessment
Affected
Go standard library net/http
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在解析包含大量小范围（small ranges）的 Range 头信息时，FileServer（FS）、ServeContent 和 ServeFile（FS）可能会消耗过多的 CPU 资源。
Possible ATT&CK Techniques 1 AI
T1496 · Resource Hijacking
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Lack of limit on size of parsed Range headers in net/http
Source: CVE Program / CVE List V5
Vulnerability Description
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Go standard library | net/http | 0 ~ 1.26.9 | - |
|
II. Public POCs for CVE-2026-78667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78667
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78667 (1)
Vendor Pages for CVE-2026-78667 (1)
Other References for CVE-2026-78667 (1)
Other References for CVE-2026-78667 (1)
Same Patch Batch · Go standard library · 2026-10-08 · 13 CVEs total
| CVE-2026-94439 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | |
| CVE-2026-94440 | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart | |
| CVE-2026-94448 | Reset context tracking on consecutive template expressions in html/template | |
| CVE-2026-56857 | Root.Mkdir(All) can follow junctions out of the root on Windows in os | |
| CVE-2026-56866 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http | |
| CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http | |
| CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http | |
| CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | |
| CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http | |
| CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http | |
| CVE-2026-97030 | Recognize yield as regexp preceder keyword in html/template | |
| CVE-2026-97031 | Reject malformed ECH outer extension references in crypto/tls |
IV. Related Vulnerabilities
Same product: net/http
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http -
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/h -
CVE-2026-78669
Excessive CPU consumption from repeated initial window chang -
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT -
CVE-2026-78660
HTTP/2 transport accepts malformed framing-related headers i
Same vendor: Go standard library
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http -
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/h -
CVE-2026-78669
Excessive CPU consumption from repeated initial window chang -
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT -
CVE-2026-97031
Reject malformed ECH outer extension references in crypto/tl
V. Comments for CVE-2026-78667
No comments yet