CVE-2026-78667

Summary

The flaw allows attackers to cause excessive CPU consumption when processing Range headers with many small ranges, potentially leading to denial of service. This affects Go's FileServer implementations and can be exploited by sending specially crafted HTTP requests.

Exploitability

Exploitation is relatively straightforward requiring only a single HTTP request with a malformed Range header containing many small ranges, with no authentication or access preconditions needed.

Blast radius

The impact could affect any web application using Go's FileServer, ServeContent, or ServeFile functions, potentially causing widespread service disruption across multiple applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Go 1.23.0 or later which includes the fix for this CPU consumption issue in FileServer implementations.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.