{"id":"EUVD-2026-123113","revision":null,"records":[{"revision":"d9be7a7dd4994976bb7219317b8dd3a2","observedAt":"2026-11-11T04:25:37.534+00:00","statement":{"source":"cve-program","id":"CVE-2026-97054","aliases":[],"title":"HTTP/1 server crash due to MaxBytesReader header race in net/http","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","state":0,"publishedAt":"2026-11-11T03:13:17.877+00:00","modifiedAt":"2026-11-11T03:13:17.877+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"net/http","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"vendor\": \"Go standard library\",\n \"product\": \"net/http\",\n \"collectionURL\": \"https://pkg.go.dev\",\n \"packageName\": \"net/http\",\n \"versions\": [\n {\n \"version\": \"0\",\n \"lessThan\": \"1.26.11\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"1.27.0-0\",\n \"lessThan\": \"1.27.4\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ],\n \"programRoutines\": [\n {\n \"name\": \"maxBytesReader.Read\"\n },\n {\n \"name\": \"CanonicalHeaderKey\"\n },\n {\n \"name\": \"Client.CloseIdleConnections\"\n },\n {\n \"name\": \"Client.Do\"\n },\n {\n \"name\": \"Client.Get\"\n },\n {\n \"name\": \"Client.Head\"\n },\n {\n \"name\": \"Client.Post\"\n },\n {\n \"name\": \"Client.PostForm\"\n },\n {\n \"name\": \"ClientConn.Close\"\n },\n {\n \"name\": \"ClientConn.RoundTrip\"\n },\n {\n \"name\": \"Cookie.String\"\n },\n {\n \"name\": \"Cookie.Valid\"\n },\n {\n \"name\": \"CrossOriginProtection.AddInsecureBypassPattern\"\n },\n {\n \"name\": \"CrossOriginProtection.AddTrustedOrigin\"\n },\n {\n \"name\": \"CrossOriginProtection.Check\"\n },\n {\n \"name\": \"Dir.Open\"\n },\n {\n \"name\": \"Error\"\n },\n {\n \"name\": \"Get\"\n },\n {\n \"name\": \"Handle\"\n },\n {\n \"name\": \"HandleFunc\"\n },\n {\n \"name\": \"HandlerFunc.ServeHTTP\"\n },\n {\n \"name\": \"Head\"\n },\n {\n \"name\": \"Header.Add\"\n },\n {\n \"name\": \"Header.Del\"\n },\n {\n \"name\": \"Header.Get\"\n },\n {\n \"name\": \"Header.Set\"\n },\n {\n \"name\": \"Header.Values\"\n },\n {\n \"name\": \"Header.Write\"\n },\n {\n \"name\": \"Header.WriteSubset\"\n },\n {\n \"name\": \"ListenAndServe\"\n },\n {\n \"name\": \"ListenAndServeTLS\"\n },\n {\n \"name\": \"NewRequest\"\n },\n {\n \"name\": \"NewRequestWithContext\"\n },\n {\n \"name\": \"NotFound\"\n },\n {\n \"name\": \"ParseCookie\"\n },\n {\n \"name\": \"ParseSetCookie\"\n },\n {\n \"name\": \"ParseTime\"\n },\n {\n \"name\": \"Post\"\n },\n {\n \"name\": \"PostForm\"\n },\n {\n \"name\": \"ProxyFromEnvironment\"\n },\n {\n \"name\": \"ReadRequest\"\n },\n {\n \"name\": \"ReadResponse\"\n },\n {\n \"name\": \"Redirect\"\n },\n {\n \"name\": \"Request.AddCookie\"\n },\n {\n \"name\": \"Request.BasicAuth\"\n },\n {\n \"name\": \"Request.Cookie\"\n },\n {\n \"name\": \"Request.Cookies\"\n },\n {\n \"name\": \"Request.CookiesNamed\"\n },\n {\n \"name\": \"Request.FormFile\"\n },\n {\n \"name\": \"Request.FormValue\"\n },\n {\n \"name\": \"Request.MultipartReader\"\n },\n {\n \"name\": \"Request.ParseForm\"\n },\n {\n \"name\": \"Request.ParseMultipartForm\"\n },\n {\n \"name\": \"Request.PostFormValue\"\n },\n {\n \"name\": \"Request.Referer\"\n },\n {\n \"name\": \"Request.SetBasicAuth\"\n },\n {\n \"name\": \"Request.UserAgent\"\n },\n {\n \"name\": \"Request.Write\"\n },\n {\n \"name\": \"Request.WriteProxy\"\n },\n {\n \"name\": \"Response.Cookies\"\n },\n {\n \"name\": \"Response.Location\"\n },\n {\n \"name\": \"Response.Write\"\n },\n {\n \"name\": \"ResponseController.EnableFullDuplex\"\n },\n {\n \"name\": \"ResponseController.Flush\"\n },\n {\n \"name\": \"ResponseController.Hijack\"\n },\n {\n \"name\": \"ResponseController.SetReadDeadline\"\n },\n {\n \"name\": \"ResponseController.SetWriteDeadline\"\n },\n {\n \"name\": \"Serve\"\n },\n {\n \"name\": \"ServeContent\"\n },\n {\n \"name\": \"ServeFile\"\n },\n {\n \"name\": \"ServeFileFS\"\n },\n {\n \"name\": \"ServeMux.Handle\"\n },\n {\n \"name\": \"ServeMux.HandleFunc\"\n },\n {\n \"name\": \"ServeMux.ServeHTTP\"\n },\n {\n \"name\": \"ServeTLS\"\n },\n {\n \"name\": \"Server.Close\"\n },\n {\n \"name\": \"Server.ListenAndServe\"\n },\n {\n \"name\": \"Server.ListenAndServeTLS\"\n },\n {\n \"name\": \"Server.Serve\"\n },\n {\n \"name\": \"Server.ServeTLS\"\n },\n {\n \"name\": \"Server.SetKeepAlivesEnabled\"\n },\n {\n \"name\": \"Server.Shutdown\"\n },\n {\n \"name\": \"SetCookie\"\n },\n {\n \"name\": \"Transport.CancelRequest\"\n },\n {\n \"name\": \"Transport.Clone\"\n },\n {\n \"name\": \"Transport.CloseIdleConnections\"\n },\n {\n \"name\": \"Transport.NewClientConn\"\n },\n {\n \"name\": \"Transport.RoundTrip\"\n },\n {\n \"name\": \"body.Close\"\n },\n {\n \"name\": \"body.Read\"\n },\n {\n \"name\": \"bodyEOFSignal.Close\"\n },\n {\n \"name\": \"bodyEOFSignal.Read\"\n },\n {\n \"name\": \"bodyLocked.Read\"\n },\n {\n \"name\": \"bufioFlushWriter.Write\"\n },\n {\n \"name\": \"cancelTimerBody.Close\"\n },\n {\n \"name\": \"cancelTimerBody.Read\"\n },\n {\n \"name\": \"checkConnErrorWriter.Write\"\n },\n {\n \"name\": \"chunkWriter.Write\"\n },\n {\n \"name\": \"connReader.Read\"\n },\n {\n \"name\": \"connectMethodKey.String\"\n },\n {\n \"name\": \"expectContinueReader.Close\"\n },\n {\n \"name\": \"expectContinueReader.Read\"\n },\n {\n \"name\": \"extraHeader.Write\"\n },\n {\n \"name\": \"fileHandler.ServeHTTP\"\n },\n {\n \"name\": \"fileTransport.RoundTrip\"\n },\n {\n \"name\": \"globalOptionsHandler.ServeHTTP\"\n },\n {\n \"name\": \"gzipReader.Close\"\n },\n {\n \"name\": \"gzipReader.Read\"\n },\n {\n \"name\": \"http1ClientConn.Close\"\n },\n {\n \"name\": \"http1ClientConn.RoundTrip\"\n },\n {\n \"name\": \"http2ClientConn.RoundTrip\"\n },\n {\n \"name\": \"http2Handler.ServeHTTP\"\n },\n {\n \"name\": \"http2ResponseWriter.Flush\"\n },\n {\n \"name\": \"http2ResponseWriter.FlushError\"\n },\n {\n \"name\": \"http2ResponseWriter.Push\"\n },\n {\n \"name\": \"http2RoundTripper.RoundTrip\"\n },\n {\n \"name\": \"http3ServerHandler.ServeHTTP\"\n },\n {\n \"name\": \"initALPNRequest.ServeHTTP\"\n },\n {\n \"name\": \"loggingConn.Close\"\n },\n {\n \"name\": \"loggingConn.Read\"\n },\n {\n \"name\": \"loggingConn.Write\"\n },\n {\n \"name\": \"maxBytesReader.Close\"\n },\n {\n \"name\": \"onceCloseListener.Close\"\n },\n {\n \"name\": \"persistConn.Read\"\n },\n {\n \"name\": \"persistConnWriter.ReadFrom\"\n },\n {\n \"name\": \"persistConnWriter.Write\"\n },\n {\n \"name\": \"populateResponse.Write\"\n },\n {\n \"name\": \"populateResponse.WriteHeader\"\n },\n {\n \"name\": \"readTrackingBody.Close\"\n },\n {\n \"name\": \"readTrackingBody.Read\"\n },\n {\n \"name\": \"readWriteCloserBody.CloseWrite\"\n },\n {\n \"name\": \"readWriteCloserBody.Read\"\n },\n {\n \"name\": \"redirectHandler.ServeHTTP\"\n },\n {\n \"name\": \"response.Flush\"\n },\n {\n \"name\": \"response.FlushError\"\n },\n {\n \"name\": \"response.Hijack\"\n },\n {\n \"name\": \"response.ReadFrom\"\n },\n {\n \"name\": \"response.Write\"\n },\n {\n \"name\": \"response.WriteHeader\"\n },\n {\n \"name\": \"response.WriteString\"\n },\n {\n \"name\": \"serverHandler.ServeHTTP\"\n },\n {\n \"name\": \"socksDialer.DialWithConn\"\n },\n {\n \"name\": \"socksUsernamePassword.Authenticate\"\n },\n {\n \"name\": \"stringWriter.WriteString\"\n },\n {\n \"name\": \"timeoutHandler.ServeHTTP\"\n },\n {\n \"name\": \"timeoutWriter.Write\"\n },\n {\n \"name\": \"timeoutWriter.WriteHeader\"\n },\n {\n \"name\": \"transportReadFromServerError.Error\"\n },\n {\n \"name\": \"unencryptedHTTP2Request.ServeHTTP\"\n }\n ],\n \"defaultStatus\": \"unaffected\"\n }"}],"metrics":[],"references":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97054","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97054","identifiers":["CVE-2026-97054"]},"retained":false,"historicalAffected":[]},{"revision":"fdf7bf02d50c43e081956967d05ed2b5","observedAt":"2026-11-13T05:19:08.707+00:00","statement":{"source":"euvd","id":"EUVD-2026-123113","aliases":["CVE-2026-97054","GHSA-rg98-f588-44xg"],"title":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 se…","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[],"references":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123113","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 11, 2026, 3:13:17 AM","dateUpdated":"Nov 11, 2026, 3:13:17 AM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-4370","title":"Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff","vulnerabilityIds":["CVE-2026-97033","CVE-2026-97034","CVE-2026-97035","CVE-2026-97036","CVE-2026-97037","CVE-2026-97038","CVE-2026-97039","CVE-2026-97040","CVE-2026-97041","CVE-2026-97042","CVE-2026-97043","CVE-2026-97054"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-123113","identifiers":["EUVD-2026-123113","CVE-2026-97054","GHSA-rg98-f588-44xg"]},"retained":false,"historicalAffected":[]},{"revision":"30344a94e15d4faaaf163758ccd30831","observedAt":"2026-11-13T06:18:20.985+00:00","statement":{"source":"nvd","id":"CVE-2026-97054","aliases":[],"title":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 se…","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","state":0,"publishedAt":"2026-11-11T05:19:58.943+00:00","modifiedAt":"2026-11-12T22:09:39.233+00:00","affected":[],"metrics":[],"references":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","https://pkg.go.dev/vuln/GO-2026-6859"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97054","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":[],"productCriteria":[],"sourceDates":{"published":"2026-11-11T05:19:58.943","lastModified":"2026-11-12T22:09:39.233"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-97054","identifiers":["CVE-2026-97054"]},"retained":false,"historicalAffected":[]},{"revision":"a74ddd343bdc4ab0b5e512ef01aa8595","observedAt":"2026-11-11T04:27:36.086+00:00","statement":{"source":"osv","id":"GO-2026-6859","aliases":["CVE-2026-97054"],"title":"HTTP/1 server crash due to MaxBytesReader header race in net/http","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","state":0,"publishedAt":"2026-11-11T02:51:11+00:00","modifiedAt":"2026-11-11T03:15:14.8058982+00:00","affected":[{"ecosystem":"Go","name":"stdlib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.11"},{"kind":"introduced","version":"1.27.0-0"},{"kind":"fixed","version":"1.27.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/862185","https://go.dev/issue/82563","https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6859","license":"OSV · upstream source license applies","key":"osv:GO-2026-6859","identifiers":["GO-2026-6859","CVE-2026-97054"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T04:30:55.4263644+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T04:30:55.4263644+00:00","lastSuccessAt":"2026-11-15T04:30:55.5752625+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:55.5752636+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-b872efafa1f7ba70ab3a71a2f5dd75eb28928bf5b30db695cd68920ed9e1ed90","complete":true,"records":425770,"lastAttemptAt":"2026-11-15T04:30:54.3370272+00:00","lastSuccessAt":"2026-11-15T04:30:54.3276081+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:54.3370272+00:00","snapshotPublishedAt":"2026-11-15T04:29:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9ae965bb673e4dcb8be8c4f39a8efed3","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T04:39:06.2205994+00:00","lastSuccessAt":"2026-11-15T04:39:06.209+00:00","error":"48 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T04:39:06.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13826,"expectedIdentifiers":13874,"failedIdentifiers":48},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T04:30:55.4263644+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T04:30:55.4263644+00:00","lastSuccessAt":"2026-11-15T04:30:55.5792123+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:55.5792157+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b4e16143cf664d0aa856e1009c943b33","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T04:31:03.3484812+00:00","lastSuccessAt":"2026-11-15T02:30:50.077+00:00","error":"15 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T02:30:50.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13859,"expectedIdentifiers":13874,"failedIdentifiers":15},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T04:30:54.9962457+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:54.9962457+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T04:30:54.5009016+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:54.5009016+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T04:30:55.3850754+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:55.3850754+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-deb41cb32d3b3d67de7960b1647d789a5218551d33a54a4b027ba315bcba590f","complete":true,"records":232473,"lastAttemptAt":"2026-11-15T04:30:54.8874578+00:00","lastSuccessAt":"2026-11-15T01:46:53.6377511+00:00","error":null,"lastVerifiedAt":"2026-11-15T04:30:54.8874578+00:00","snapshotPublishedAt":"2026-11-15T00:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}