ALPINE-CVE-2026-97054: Alpine/go vulnerability
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.11-r0
Event History
Frequently Asked Questions
What conditions are required for this to be exploitable?
The affected service must be an HTTP/1 server using MaxBytesReader or MaxBytesHandler. Its handler must read the request body concurrently with writing response headers, and the request body must exceed the configured MaxBytesReader limit.
Are HTTP/2 servers affected?
The issue is described for HTTP/1 servers. The provided information does not identify HTTP/2 servers as affected.
What is the impact if the race occurs?
The server can terminate with a runtime panic when the unsynchronized automatic Connection: close header update races with an explicitly written response header.