CVE-2026-78667 Go standard library CVE debrief

Who should care

Defenders responsible for Go applications using the standard library's net/http package should assess exposure and apply mitigations. This includes operators, platform administrators, vulnerability management teams, and security teams. They should review the affected versions and configurations in their environments, verify exposure, and prioritize applying mitigations or patches.

Why it matters

CVE-2026-78667 is a vulnerability in the Go standard library's net/http package that can lead to excessive CPU consumption. Defenders should assess exposure, particularly in environments using affected versions, and prioritize applying mitigations.

• Potential for denial of service due to excessive CPU consumption
• Need for verification of affected versions and exposure
• Priority for applying patches or mitigations

Technical summary

The Go standard library's net/http package is vulnerable to excessive CPU consumption when parsing Range headers with large numbers of small ranges. This affects the FileServer, ServeContent, and ServeFile functions. The vulnerability is caused by the lack of a limit on the size of parsed Range headers, which can lead to performance degradation and potential denial-of-service attacks. Defenders should assess exposure and apply mitigations to prevent exploitation, particularly in environments using affected versions.

Defensive priority

Defenders should prioritize assessing exposure and applying mitigations, particularly in environments using the affected Go standard library versions.

Recommended defensive actions

• Assess exposure by reviewing the affected Go standard library versions in use
• Apply mitigations or patches as available
• Monitor CPU consumption and adjust configurations as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the source item from osv_dev, which provides details on the affected functions and potential impact on CPU consumption. The source item notes that the vulnerability can lead to excessive CPU consumption when parsing large numbers of small ranges in Range headers. This can affect the performance of applications using the affected functions in the net/http package. Defenders should verify the affected versions and configurations in their environments to assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.