Repository navigation
net/http: lack of limit on size of parsed Range headers #81858
Description
When parsing a Range header containing a large number of small ranges,
FileServer(FS), ServeContent, and ServeFile(FS) could consume an excessive
amount of CPU.
These functions now ignore Range headers containing more than 200 ranges.
The limit is controlled by the new httpservecontentmaxranges=
GODEBUG setting. Setting GODEBUG=httpservecontentmaxranges=0
disables the limit.
Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
This is CVE-2026-78667 and Go issue https://go.dev/issue/81858.
This was a PRIVATE track issue originally tracked in http://b/547887089.
Activity
thatnealpatel commentedon Sep 30, 2026
@gopherbot Please open backports for this security issue.
gopherbot commentedon Sep 30, 2026
Backport issue(s) opened: #81919 (for 1.26), #81920 (for 1.27).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847030 mentions this issue:
[release-branch.go1.27] net/http: limit the size of range headers parsed in ServeContentgopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847110 mentions this issue:
[release-branch.go1.26] net/http: limit the size of range headers parsed in ServeContent[release-branch.go1.27] net/http: limit the size of range headers par…
[release-branch.go1.26] net/http: limit the size of range headers par…
gopherbot commentedon Oct 8, 2026
Change https://go.dev/cl/847309 mentions this issue:
net/http: limit the size of range headers parsed in ServeContent[-]security: fix CVE-2026-78667[/-][+]net/http: lack of limit on size of parsed Range headers[/+]net/http: limit the size of range headers parsed in ServeContent