AZL-113621: CVE-2026-97054 affecting package python-tensorboard 2.16.2-6
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure is limited to HTTP/1 servers that use MaxBytesReader or MaxBytesHandler. The crash condition requires a handler to read the request body concurrently while writing the response header.
What must happen for an attacker to trigger the crash?
The request body must exceed the configured MaxBytesReader limit, causing the server to set Connection: close. A race can then occur if another response header is being set explicitly at the same time.
How can I determine whether my application is affected?
Review HTTP/1 request handlers for use of MaxBytesReader or MaxBytesHandler and check whether they can read the request body concurrently with response-header writes. The affected package version identified here is python-tensorboard 2.16.2-6.