Bug 2548334 (CVE-2026-78667)

Summary: CVE-2026-78667 net/http: golang: golang: Denial of Service via crafted HTTP Range headers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerability-draftAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, amctagga, ansmith, anthomas, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, chfoley, crizzo, dhanak, dkeler, dpaolell, drosa, dschmidt, dsimansk, eglynn, ehelms, flucifre, ggainey, gmeno, groman, ikhan, jbritton, jburrell, jdelft, jeder, jjoyce, jlanda, jpasqual, jpretori, jschluet, jturenov, jupierce, juwatts, kingland, kshier, lchilton, lgarciaa, lhh, mbenjamin, mbiarnes, mburns, mdellweg, mgarciac, mhackett, mhulan, mnovotny, nmoumoul, osousa, pcreech, pjindal, ppalepu, ppostler, prdhamdh, rbobbitt, rchan, rhel-process-autobot, sausingh, sfeifer, sghai, sidsharm, simaishi, smallamp, sostapov, stcannon, suppawar, swoodman, thason, tmalecek, vereddy, vkarehfa, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Go net/http package. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request containing a Range header with a large number of small byte ranges. When the server processes these ranges while serving content, it consumes an excessive amount of CPU resources, rendering the application unresponsive to legitimate users.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-08 23:01:15 UTC 
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.