{"id":"CVE-2026-78667","published":"2026-10-08T23:17:03.880","lastModified":"2026-10-09T17:16:49.690","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/847309","tags":[]},{"url":"https://go.dev/issue/81858","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6609","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows attackers to cause excessive CPU consumption when processing Range headers with many small ranges, potentially leading to denial of service. This affects Go's FileServer implementations and can be exploited by sending specially crafted HTTP requests.","exploitability":"Exploitation is relatively straightforward requiring only a single HTTP request with a malformed Range header containing many small ranges, with no authentication or access preconditions needed.","blast_radius":"The impact could affect any web application using Go's FileServer, ServeContent, or ServeFile functions, potentially causing widespread service disruption across multiple applications.","remediation":"Upgrade to Go 1.23.0 or later which includes the fix for this CPU consumption issue in FileServer implementations.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","http","go","fileserver"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:23:58.736Z"}}