{"id":"CVE-2026-97054","published":"2026-11-11T05:19:58.943","lastModified":"2026-11-11T05:19:58.943","description":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://go.dev/cl/862185","tags":[]},{"url":"https://go.dev/issue/82563","tags":[]},{"url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM","tags":[]},{"url":"https://pkg.go.dev/vuln/GO-2026-6859","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}