AZL-113444: CVE-2026-97054 affecting package golang 1.26.11-1

Q: Which applications are exposed to this race condition?

HTTP/1 servers are exposed when they use MaxBytesReader or MaxBytesHandler and their handler concurrently reads the request body while writing response headers. The described outcome is a runtime panic that can crash the server.

Q: What must happen for the issue to be triggered?

The MaxBytesReader limit must be exceeded, causing an automatic unsynchronized attempt to set Connection: close. At the same time, the handler must explicitly write a response header while another execution path is reading the request body.

Published Nov 11, 2026

Updated

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

Affected Software

1 affected component

azure-linux/golang<=1.26.11-1

Event History

Nov 11, 2026

Advisory Published

via OSV·05:19 AM

Data Sourced

via OSV·05:19 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97054

Frequently Asked Questions

Which applications are exposed to this race condition?

HTTP/1 servers are exposed when they use MaxBytesReader or MaxBytesHandler and their handler concurrently reads the request body while writing response headers. The described outcome is a runtime panic that can crash the server.

What must happen for the issue to be triggered?

The MaxBytesReader limit must be exceeded, causing an automatic unsynchronized attempt to set Connection: close. At the same time, the handler must explicitly write a response header while another execution path is reading the request body.