HIGH7.5

GO-2026-6609

Lack of limit on size of parsed Range headers in net/http

Quick fix

GO-2026-6609 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.26.9

Details

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.26.9

Fixgo get stdlib@v1.26.9

References

https://go.dev/cl/847309[FIX]
https://go.dev/issue/81858[REPORT]
https://groups.google.com/g/golang-announce/c/U2fTuyDJznI[WEB]