{"id":"GO-2026-6859","summary":"HTTP/1 server crash due to MaxBytesReader header race in net/http","details":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","aliases":["CVE-2026-97054"],"modified":"2026-11-11T03:15:14.805898236Z","published":"2026-11-11T02:51:11Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6859","review_status":"REVIEWED"},"references":[{"type":"FIX","url":"https://go.dev/cl/862185"},{"type":"REPORT","url":"https://go.dev/issue/82563"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["CanonicalHeaderKey","Client.CloseIdleConnections","Client.Do","Client.Get","Client.Head","Client.Post","Client.PostForm","ClientConn.Close","ClientConn.RoundTrip","Cookie.String","Cookie.Valid","CrossOriginProtection.AddInsecureBypassPattern","CrossOriginProtection.AddTrustedOrigin","CrossOriginProtection.Check","Dir.Open","Error","Get","Handle","HandleFunc","HandlerFunc.ServeHTTP","Head","Header.Add","Header.Del","Header.Get","Header.Set","Header.Values","Header.Write","Header.WriteSubset","ListenAndServe","ListenAndServeTLS","NewRequest","NewRequestWithContext","NotFound","ParseCookie","ParseSetCookie","ParseTime","Post","PostForm","ProxyFromEnvironment","ReadRequest","ReadResponse","Redirect","Request.AddCookie","Request.BasicAuth","Request.Cookie","Request.Cookies","Request.CookiesNamed","Request.FormFile","Request.FormValue","Request.MultipartReader","Request.ParseForm","Request.ParseMultipartForm","Request.PostFormValue","Request.Referer","Request.SetBasicAuth","Request.UserAgent","Request.Write","Request.WriteProxy","Response.Cookies","Response.Location","Response.Write","ResponseController.EnableFullDuplex","ResponseController.Flush","ResponseController.Hijack","ResponseController.SetReadDeadline","ResponseController.SetWriteDeadline","Serve","ServeContent","ServeFile","ServeFileFS","ServeMux.Handle","ServeMux.HandleFunc","ServeMux.ServeHTTP","ServeTLS","Server.Close","Server.ListenAndServe","Server.ListenAndServeTLS","Server.Serve","Server.ServeTLS","Server.SetKeepAlivesEnabled","Server.Shutdown","SetCookie","Transport.CancelRequest","Transport.Clone","Transport.CloseIdleConnections","Transport.NewClientConn","Transport.RoundTrip","body.Close","body.Read","bodyEOFSignal.Close","bodyEOFSignal.Read","bodyLocked.Read","bufioFlushWriter.Write","cancelTimerBody.Close","cancelTimerBody.Read","checkConnErrorWriter.Write","chunkWriter.Write","connReader.Read","connectMethodKey.String","expectContinueReader.Close","expectContinueReader.Read","extraHeader.Write","fileHandler.ServeHTTP","fileTransport.RoundTrip","globalOptionsHandler.ServeHTTP","gzipReader.Close","gzipReader.Read","http1ClientConn.Close","http1ClientConn.RoundTrip","http2ClientConn.RoundTrip","http2Handler.ServeHTTP","http2ResponseWriter.Flush","http2ResponseWriter.FlushError","http2ResponseWriter.Push","http2RoundTripper.RoundTrip","http3ServerHandler.ServeHTTP","initALPNRequest.ServeHTTP","loggingConn.Close","loggingConn.Read","loggingConn.Write","maxBytesReader.Close","maxBytesReader.Read","onceCloseListener.Close","persistConn.Read","persistConnWriter.ReadFrom","persistConnWriter.Write","populateResponse.Write","populateResponse.WriteHeader","readTrackingBody.Close","readTrackingBody.Read","readWriteCloserBody.CloseWrite","readWriteCloserBody.Read","redirectHandler.ServeHTTP","response.Flush","response.FlushError","response.Hijack","response.ReadFrom","response.Write","response.WriteHeader","response.WriteString","serverHandler.ServeHTTP","socksDialer.DialWithConn","socksUsernamePassword.Authenticate","stringWriter.WriteString","timeoutHandler.ServeHTTP","timeoutWriter.Write","timeoutWriter.WriteHeader","transportReadFromServerError.Error","unencryptedHTTP2Request.ServeHTTP"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6859.json"}}],"schema_version":"1.9.2","credits":[{"name":"Jakub Ciolek (https://ciolek.dev)"}]}