HTTP/1 server crash due to MaxBytesReader header race in net/http
Historical advisory recorded 11 Nov 2026 04:25:37 UTC. Read the latest advisory.
cve-program · CVE-2026-97054
PublishedFor HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-97054
PublishedHTTP/1 server crash due to MaxBytesReader header race in net/http
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
- Source published
- 11 Nov 2026 03:13:17 UTC
- Source modified
- 11 Nov 2026 03:13:17 UTC
- Saved here
- 11 Nov 2026 04:25:37 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.