Concurrency Issue in HTTP/1 Servers Using MaxBytesReader by The Go Programming Language

CVE-2026-97054

What is CVE-2026-97054?

A concurrency vulnerability has been identified in HTTP/1 servers developed in Go when utilizing the MaxBytesReader and MaxBytesHandler components. When the configured limit of MaxBytesReader is exceeded, an automatic 'Connection: close' header is set without proper synchronization. This may lead to race conditions, especially if the server handler attempts to read the request body at the same time as writing the response header. Such conditions can result in a runtime panic, causing the server to crash unexpectedly and impacting service availability.

References