Fluid Attacks Database

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	stdlib	>=0 <1.26.9	1.26.9
debian 12	golang-1.19	=1.19.10-1 \|\| =1.19.10-2 \|\| =1.19.11-1 \|\| =1.19.12-1 \|\| =1.19.12-2 \|\| =1.19.12-2~bpo11+1 \|\| =1.19.12-2~bpo12+1 \|\| =1.19.13-1 \|\| =1.19.13-1~bpo11+1 \|\| =1.19.13-1~bpo12+1 \|\| =1.19.8-2 \|\| =1.19.9-1	-
debian 14	golang-1.26	=1.26.0-1 \|\| =1.26.1-1 \|\| =1.26.2-1 \|\| =1.26.2-2 \|\| =1.26.2-3 \|\| =1.26.3-1 \|\| =1.26.3-1~bpo13+1 \|\| =1.26.3-2 \|\| =1.26.3-2~bpo13+1 \|\| =1.26.4-1 \|\| =1.26.4-1~bpo13+1 \|\| =1.26.5-1 \|\| =1.26.5-1~bpo13+1 \|\| =1.26.6-1 \|\| =1.26.6-2 \|\| =1.26.7-1 \|\| =1.26.7-1~bpo13+1 \|\| =1.26.8-1 \|\| =1.26.8-1~bpo13+1 \|\| =1.26.8-2 \|\| =1.26~rc2-1 \|\| =1.26~rc3-1 \|\| =1.26~rc3-2 \|\| >=0 <1.26.9-1	1.26.9-1
debian 14	golang-1.27	=1.27.0-1 \|\| =1.27.0-1~bpo13+1 \|\| =1.27.1-1 \|\| =1.27.1-2 \|\| =1.27.1-2~bpo13+1 \|\| =1.27~rc1-1 \|\| =1.27~rc2-1 \|\| =1.27~rc3-1 \|\| >=0 <1.27.2-1	1.27.2-1
rpm rhel8	conmon	-	-
rpm rhel9	containernetworking-plugins	-	-
rpm rhel9	delve	-	-
rpm rhel10	git-lfs	-	-
rpm rhel8	git-lfs	-	-
rpm rhel10	golang	<0:1.26.10-1.el10_2	0:1.26.10-1.el10_2

1-10 of 64

Aliases

1. CVE-2026-786672. NVD-2026-786673. OSV-GO-2026-66094. OSV-2026-786675. OSV-DEBIAN-2026-786676. GCVE-2026-786677. SECURITY-TRACKER-CVE-2026-78667

References

1. https://go.dev/cl/8473092. https://go.dev/issue/818583. https://groups.google.com/g/golang-announce/c/U2fTuyDJznI

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.