Go net/http MaxBytesReader race causes panic (CVE-2026-97054)
CVE-2026-97054 Published on November 11, 2026
HTTP/1 server crash due to MaxBytesReader header race in net/http
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Products Associated with CVE-2026-97054
Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.
Affected Versions
Go standard library net/http:- Before 1.26.11 is affected.
- Version 1.27.0-0 and below 1.27.4 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.