CPU Resource Exhaustion Vulnerability in FileServer Component of Go
CVE-2026-78667

Currently unrated

Key Information:

Vendor: Go Standard Library
Status: Net/http
Vendor: CVE Published:; 8 October 2026

🔔 Create Go Standard Library Vulnerability Alert

What is CVE-2026-78667?

The FileServer component of the Go programming language is susceptible to a vulnerability arising from the improper handling of Range headers containing multiple small ranges. This flaw may lead to excessive CPU resource consumption, potentially affecting server performance and responsiveness during high load scenarios.

Affected Version(s)

net/http 0 < 1.26.9

net/http 1.27.0-0 < 1.27.2

References

https://go.dev/cl/847309

https://go.dev/issue/81858

https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 8, 2026
Vulnerability Reserved
Aug 24, 2026

Credit

Jakub Ciolek (https://ciolek.dev)

CVE-2026-78667 Data

JSON