Skip to content
fr Sign in
7.5 High

CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)…

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Affected products and versions

Product Affected versions Fixed in
net/http 1.27 1.27.0-0 → < 1.27.2 1.27.2
net/http 1.26 earliest → < 1.26.9 1.26.9

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/http

The 26 CVEs of net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 High CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 High CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critical CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they… 7.5 High
Track this CVE